DSL-6740C FIRMWARE · CVE-2026-129444 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The D-Link DSL-6740C router firmware (version 20131126) ships with hard-coded credentials in its FTP daemon configuration file. A remote attacker can use those credentials to access the device, and a public exploit is available.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of a D-Link DSL-6740C router running the 20131126 firmware build. The FTP daemon config /etc/templates/ftpd/ftpd_conf.php holds hard-coded credentials, and VulDB says the attack is remote and needs no authentication. Whether FTP is on or reachable from the internet by default is not stated in any source I read. Anyone with another router model can skip it.
Not affected if firmware-updated, ftp-not-exposed, other-hardware
Who cares d-link, dsl-6740c, end-of-life, ftp, hard-coded-credentials, home-router
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was identified in D-Link DSL-6740C 20131126. This affects an unknown function of the file /etc/templates/ftpd/ftpd_conf.php of the component FTP Daemon. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.