Live › vulnerability › CVE-2026-113735
Go to dashboardThe D-Link DCS-6501LH camera firmware 3.03.02 sets its root password through a mydlink function in /mnt/mtd/aoni_ipc using weak credentials. A remote attacker with a high-complexity path could gain access to the camera as root, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running D-Link DCS-6501LH cameras on firmware 3.03.02, especially where the camera is reachable from outside the local network or mydlink remote features are on. Devices kept on an isolated LAN with no remote access are much less exposed. Anyone not running this camera model can skip it.
No product ranges from the sources yet.
3.03.02.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized.
This page as .md · .json · in your agent: get_signal("CVE-2026-113735")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.