CVE-2023-51987 is a critical severity (9.8 CVSS) authentication bypass in the HNAP1 interface of the D-Link DIR-822+ router, firmware V1.0.2. It allows an administrator login with an empty password. We could not confirm a fixed firmware, so check D-Link's advisories and limit management access now.
What's affected
The NVD record lists D-Link DIR-822+ firmware 1.0.2 and the DIR-822+ hardware. The only reference in the record is a researcher write-up on GitHub, which names V1.0.2 and does not mention a patch, a fixed firmware version or a vendor response.
We did not find a vendor advisory to fetch, so we cannot state a fixed version. Check D-Link's support and security advisory pages for the DIR-822+ and confirm whether the model is still supported. Routers that have reached end of life often never receive a fix.
How to check if you're exposed
Log in to the router's admin page and read the firmware version on the status or maintenance screen. If it shows V1.0.2, treat the device as affected.
Then check exposure. Look at whether the management interface is reachable from the internet, from guest networks or from untrusted VLANs. From a device outside the network, a port scan of the router's public address against the web management ports tells you whether it is exposed. Only scan equipment you own.
What to do now
- Identify every DIR-822+ in your estate, including branch offices and home worker devices.
- Check D-Link's support page for newer firmware and install it if one exists.
- Turn off remote management and restrict the admin interface to a trusted management network.
- Change the admin password anyway and review the device for unexpected configuration changes.
- If the device is end of life with no fix, plan to replace it.
Why it matters
The record maps the issue to CWE-306, missing authentication for a critical function. The researcher's write-up describes the root cause as a flawed password comparison in the HNAP1 login logic: the check compares the server calculated password with the client supplied one using a length limited comparison, and the length comes from the attacker's input. That lets an empty value pass when it should fail.
The vector is network based with no privileges and no user interaction, which is why the score is 9.8. An admin login on a router lets an attacker change DNS, routing and firewall settings for every device behind it. The KEV flag is false and the sources we read do not claim exploitation in the wild.
For a wider view, the free in-browser dependency scan and the Gold directory help you see which packaged components in your own code carry known CVEs, and reachability analysis helps you decide which ones matter first.
Quick check
Does a strong admin password protect me?
Not against this flaw. The weakness is in how the login check compares passwords, so the strength of the stored password does not help. Restrict who can reach the interface.
Sources
Last reviewed: 19 October 2026.
