QwikSec

Security Database

CVE

CWE

Training

CVE-2026-1744

Published: Feb 2, 2026

Modified: Feb 23, 2026

PUBLISHED

CVSS v3.1

2.4

LOW

Description

A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulation of the argument Username results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Vendor	Product	Versions
D-Link	DSL-6641K	affected `N8.TR069.20131126`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

References

VDB-343675 | D-Link DSL-6641K sp_pppoe_user.js doSubmitPPP cross site scripting

vdb-entry

technical-description

VDB-343675 | CTI Indicators (IOB, IOC, TTP, IOA)

signature

permissions-required

Submit #742439 | D-Link DSL6641K version N8.TR069.20131126 Cross Site Scripting

third-party-advisory

https://tzh00203.notion.site/D-Link-DSL6641K-version-N8-TR069-20131126-XSS-via-sp_pppoe_user-js-Configuration-2eeb5c52018a80d083aaf19efbaa9130?source=copy_link

exploit

https://www.dlink.com/

product

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.