CVE-2026-125079 · Infrastructure
NO FIX YET
The D-Link DCS-6501LH camera firmware 3.03.02 ships hard-coded credentials in the Media Service, tied to the pin_code argument in SystemConfig.ini handling. A remote attacker can use these built-in credentials to gain access to the camera, and a public exploit has been disclosed.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Owners of D-Link DCS-6501LH cameras running firmware 3.03.02 are exposed, especially if the camera's Media Service is reachable from the network or internet. The sources do not say whether other firmware versions are affected or whether a default configuration is required.
Not affected if other-firmware-versions
Who cares d-link, dcs-6501lh, firmware, iot-camera
3.03.02No fix yet, per the sources.
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pf_get_onvif_user_pwd/mydlink_default_sys_info of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pin_code causes hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.