CVE-2026-7027 D-Link DSL-2740R Wireless Setup Section cross site scripting
Remote attackers can inject malicious scripts via the Wireless Network Name field in the D-Link DSL-2740R router's wireless setup section.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-7027?
CVE-2026-7027 is a medium-severity cross-site scripting vulnerability in D-Link DSL-2740R, published on 26 Apr 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability was identified in D-Link DSL-2740R EU_01.15. Impacted is an unknown function of the component Wireless Setup Section. Such manipulation of the argument Wireless Network Name leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used.
Which versions are affected by CVE-2026-7027?
It affects 1 product.
Products include Dlink Dsl-2740r Firmware.
How do I fix CVE-2026-7027?
No fix has been published for CVE-2026-7027 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-7027 being exploited?
There is no known exploitation of CVE-2026-7027 in the wild and no public exploit code.
Other vulnerabilities in D-Link DSL-2740R
Sources
Also known as GHSA-x85h-2g56-9544.