A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pf_get_onvif_user_pwd/mydlink_default_sys_info of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pin_code causes hard-coded credentials.
It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 6
https://github.com/XueDugu/dlink-dcs6501lh-media-service-credential-evidence
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-125079
cna@vuldb.com
https://vuldb.com/submit/1041047
cna@vuldb.com
https://vuldb.com/vuln/433190
cna@vuldb.com
https://vuldb.com/vuln/433190/cti
cna@vuldb.com
https://www.dlink.com/
cna@vuldb.com