{"id":"CVE-2026-113735","kind":"vulnerability","aliases":["CVE-2026-113735"],"related":[],"title":"D-Link DCS-6501LH camera: mydlink root password setter uses weak credentials","description":"A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized.","summary":"The D-Link DCS-6501LH camera firmware 3.03.02 sets its root password through a mydlink function in /mnt/mtd/aoni_ipc using weak credentials. A remote attacker with a high-complexity path could gain access to the camera as root, and a public exploit has been disclosed.","severity":"low","cvss":3.7,"epss":0.00588,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cameras","d-link","infrastructure","iot","self-hosted"],"not_affected_if":["isolated-network","no-mydlink","other-models"],"how_to_check":"- Check the firmware version on the camera's web interface or system info page; the affected version is `3.03.02`.\n- Confirm whether mydlink cloud features are enabled on the camera.\n- unknown for a file-level check on the device.","fix":"- unknown: the sources do not name a fixed firmware version.\n- Until a vendor fix is confirmed, disable mydlink remote access and keep the camera off the internet.\n- Change the root and admin passwords to unique strong values.","status":"open","published_at":"2026-10-21T00:17:49+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:43:35+00:00","updated_at":"2026-10-25T04:43:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:43:35Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed firmware version.\n- Until a vendor fix is confirmed, disable mydlink remote access and keep the camera off the internet.\n- Change the root and admin passwords to unique strong values.","reach":"internet","title":"D-Link DCS-6501LH camera: mydlink root password setter uses weak credentials","impact":"high","summary":"The D-Link DCS-6501LH camera firmware 3.03.02 sets its root password through a mydlink function in /mnt/mtd/aoni_ipc using weak credentials. A remote attacker with a high-complexity path could gain access to the camera as root, and a public exploit has been disclosed.","category":"infrastructure","nicknames":[],"who_cares":["d-link","iot","cameras","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker logs in as root on the camera using weak credentials.","analyst_note":"Check the NVD entry and D-Link's advisory for a fixed firmware version and confirm whether the root password weakness is default or derived credentials.","how_to_check":"- Check the firmware version on the camera's web interface or system info page; the affected version is `3.03.02`.\n- Confirm whether mydlink cloud features are enabled on the camera.\n- unknown for a file-level check on the device.","needs_analyst":true,"not_affected_if":["other-models","no-mydlink","isolated-network"],"who_is_affected":"Teams running D-Link DCS-6501LH cameras on firmware 3.03.02, especially where the camera is reachable from outside the local network or mydlink remote features are on. Devices kept on an isolated LAN with no remote access are much less exposed. Anyone not running this camera model can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00066,"input_tokens":3398,"output_tokens":641,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-113735':17A,20A '-2026':16A,19A '/mnt/mtd/aoni_ipc':49B,103C '3.03.02':39B,88C '6501lh':6A,36B,87C 'access':64B 'affect':89C 'appear':130C 'attack':55B,115C,121C 'camera':7A,21B,37B,67B 'complex':60B,127C 'could':62B 'credenti':14A,52B,113C 'cve':15A,18A 'd':2A,23B,32B,83C 'd-link':1A,22B,31B,82C 'dcs':5A,35B,86C 'dcs-6501lh':4A,34B,85C 'determin':80C 'difficult':133C 'disclos':76B,139C 'execut':104C 'exploit':73B,129C,135C 'file':102C 'firmwar':38B 'function':47B,95C 'gain':63B 'high':59B,124C 'high-complex':58B 'host':29B 'infrastructur':25B 'iot':26B 'launch':118C 'lead':108C 'level':125C 'link':3A,24B,33B,84C 'manipul':106C 'may':116C,141C 'mydlink':8A,46B,96C 'password':10A,43B 'path':61B 'public':72B,138C 'pwd':99C 'remot':54B,119C 'requir':122C 'root':9A,42B,69B,98C 'self':28B 'self-host':27B 'set':40B,97C 'setter':11A 'use':12A,50B,110C 'util':143C 'vulner':78C,92C 'weak':13A,51B,112C","nicknames":[],"mitigations":[],"who_affected":"Teams running D-Link DCS-6501LH cameras on firmware 3.03.02, especially where the camera is reachable from outside the local network or mydlink remote features are on. Devices kept on an isolated LAN with no remote access are much less exposed. Anyone not running this camera model can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T00:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113735","severity":null,"published_at":"2026-10-21T00:17:49+00:00","modified_at":"2026-10-21T16:17:25+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113735","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113735","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}