CVE-2026-125079
Deferred Deferred - Pending Action

Hard-Coded Credentials in D-Link DCS-6501LH Firmware

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulDB

Description
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pf_get_onvif_user_pwd/mydlink_default_sys_info of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pin_code causes hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125079
EUVD
EUVD-2026-120655

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
D-Link DCS-6501LH 3.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in D-Link DCS-6501LH 3.03.02 involves hard-coded credentials in the media service. The device uses a default username 'admin' and password '174250' when it fails to read the 'pin_code' from its configuration file. This flaw allows remote attackers to gain unauthorized access to the device's media service.

Detection Guidance

Check if your D-Link DCS-6501LH device is listening on ports 554 (RTSP), 6000 (HTTP), or 7000 (HTTPS) using network scanning tools like nmap. Verify if the hard-coded credentials 'admin' with password '174250' are accepted during authentication attempts on these ports.

Impact Analysis

An attacker could exploit this to access the device's media service remotely, potentially viewing video feeds or intercepting data. Since the credentials are hard-coded, they cannot be changed through normal configuration, leaving affected devices vulnerable until patched.

Compliance Impact

This vulnerability may violate compliance requirements for data protection (e.g., GDPR, HIPAA) due to unauthorized access risks. Hard-coded credentials undermine security controls, potentially leading to data breaches and non-compliance with privacy regulations.

Mitigation Strategies

Isolate the affected device from critical networks. Update the firmware to the latest version if available. Disable unnecessary services like RTSP, HTTP, or HTTPS if not required. Change default credentials if possible, though this may not fully resolve the issue due to hard-coded fallback credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...