{"id":"CVE-2026-129444","kind":"vulnerability","aliases":["CVE-2026-129444"],"related":[],"title":"D-Link DSL-6740C router: hard-coded credentials in FTP daemon config","description":"A vulnerability was identified in D-Link DSL-6740C 20131126. This affects an unknown function of the file /etc/templates/ftpd/ftpd_conf.php of the component FTP Daemon. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used.","summary":"The D-Link DSL-6740C router firmware (version 20131126) ships with hard-coded credentials in its FTP daemon configuration file. A remote attacker can use those credentials to access the device, and a public exploit is available.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DSL-6740C firmware","fixed":[],"affected":"20131126 (Rev.A S5/N5 TR069 build)","ecosystem":"vendor"}],"ecosystems":[],"tags":["d-link","dsl-6740c","end-of-life","ftp","hard-coded-credentials","home-router","infrastructure"],"not_affected_if":["firmware-updated","ftp-not-exposed","other-hardware"],"how_to_check":"- Applies to DSL-6740C ADSL2+ router (Rev.A) S5/N5 TR069 builds dated 20131126 (per the VulDB submission). Compare the firmware build in the admin page.\n- From outside your network, check whether the router answers on FTP (TCP 21). Do not test with the built-in credentials on devices you do not own.\n- Also check other DSL-6740C builds you run (for example ISP-supplied v6.TR069.20211230): the sources do not say whether they carry this file.","fix":"No fix: D-Link lists the DSL-6740C (all hardware revisions) as end-of-life/end-of-service since no later than 15 Jan 2024 (SAP10414) and recommends replacing it. No firmware fix for this CVE is known.","status":"open","published_at":"2026-11-15T09:16:44+00:00","first_seen_at":"2026-11-15T09:34:41+00:00","triaged_at":"2026-11-15T09:35:00+00:00","updated_at":"2026-11-15T09:35:36+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-15T09:35:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link DSL-6740C router: hard-coded credentials in FTP daemon config","impact":"high","summary":"The D-Link DSL-6740C router firmware (version 20131126) ships with hard-coded credentials in its FTP daemon configuration file. A remote attacker can use those credentials to access the device, and a public exploit is available.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["d-link","dsl-6740c","home-router","ftp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker logs into the router using built-in credentials","analyst_note":"Confirm whether the FTP daemon is enabled by default and whether D-Link has published a fixed firmware version for DSL-6740C.","how_to_check":"- Check the router's firmware version in its admin interface and compare it to `20131126`\n- Look for an FTP service exposed on the device and whether it accepts the built-in credentials\n- unknown for any further check, as the sources do not say","plain_action":"If you own a D-Link DSL-6740C router, check with D-Link for a firmware update and turn off remote access to the router until one is installed.","product_name":"","needs_analyst":true,"not_affected_if":["other-hardware","firmware-updated"],"who_is_affected":"Devices running D-Link DSL-6740C firmware 20131126 are exposed, since the FTP daemon uses hard-coded credentials from /etc/templates/ftpd/ftpd_conf.php. Networks that do not run this router model can skip it. unknown whether a remote FTP service is reachable by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000768,"input_tokens":4553,"output_tokens":626,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the FTP daemon is enabled by default and whether D-Link has published a fixed firmware version for DSL-6740C.","search":"'-129444':18A,21A '-2026':17A,20A '/etc/templates/ftpd/ftpd_conf.php':105C '20131126':55B,96C '6740c':6A,24A,31B,51B,95C 'access':76B 'affect':98C 'attack':70B,120C 'avail':84B,129C 'code':10A,39B,60B,117C 'compon':108C 'config':15A 'configur':66B 'credenti':11A,40B,61B,74B,118C 'cve':16A,19A 'd':2A,27B,47B,91C 'd-link':1A,26B,46B,90C 'daemon':14A,65B,110C 'devic':78B 'dsl':5A,23A,30B,50B,94C 'dsl-6740c':4A,22A,29B,49B,93C 'end':33B 'end-of-lif':32B 'execut':123C 'exploit':82B,126C 'file':67B,104C 'firmwar':53B 'firmware':25A 'ftp':13A,36B,64B,109C 'function':101C 'hard':9A,38B,59B,116C 'hard-cod':8A,58B,115C 'hard-coded-credenti':37B 'home':42B 'home-rout':41B 'identifi':88C 'infrastructur':44B 'lead':113C 'life':35B 'link':3A,28B,48B,92C 'manipul':112C 'might':131C 'public':81B,128C 'remot':69B,124C 'router':7A,43B,52B 'ship':56B 'unknown':100C 'use':72B,133C 'version':54B 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Owners of a D-Link DSL-6740C router running the 20131126 firmware build. The FTP daemon config /etc/templates/ftpd/ftpd_conf.php holds hard-coded credentials, and VulDB says the attack is remote and needs no authentication. Whether FTP is on or reachable from the internet by default is not stated in any source I read. Anyone with another router model can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you have a D-Link DSL-6740C router, replace it with a supported model, because D-Link no longer provides updates for it. Until then, turn off remote access to the router.","pkeys":["dsl6740cfirmware","firmware"],"ptokens":["6740c","dsl","firmware"],"labels":["critical","dlink","dsl6740c","endoflife","ftp","hardcodedcredentials","homerouter","infrastructure"],"campaign_type":null,"search_a":"'-129444':18A,21A '-2026':17A,20A '6740c':6A,24A 'code':10A 'config':15A 'credenti':11A 'cve':16A,19A 'd':2A 'd-link':1A 'daemon':14A 'dsl':5A,23A 'dsl-6740c':4A,22A 'firmware':25A 'ftp':13A 'hard':9A 'hard-cod':8A 'link':3A 'router':7A","search_b":"'20131126':55B '6740c':31B,51B 'access':76B 'attack':70B 'avail':84B 'code':39B,60B 'configur':66B 'credenti':40B,61B,74B 'd':27B,47B 'd-link':26B,46B 'daemon':65B 'devic':78B 'dsl':30B,50B 'dsl-6740c':29B,49B 'end':33B 'end-of-lif':32B 'exploit':82B 'file':67B 'firmwar':53B 'ftp':36B,64B 'hard':38B,59B 'hard-cod':58B 'hard-coded-credenti':37B 'home':42B 'home-rout':41B 'infrastructur':44B 'life':35B 'link':28B,48B 'public':81B 'remot':69B 'router':43B,52B 'ship':56B 'use':72B 'version':54B","search_c":"'/etc/templates/ftpd/ftpd_conf.php':105C '20131126':96C '6740c':95C 'affect':98C 'attack':120C 'avail':129C 'code':117C 'compon':108C 'credenti':118C 'd':91C 'd-link':90C 'daemon':110C 'dsl':94C 'dsl-6740c':93C 'execut':123C 'exploit':126C 'file':104C 'ftp':109C 'function':101C 'hard':116C 'hard-cod':115C 'identifi':88C 'lead':113C 'link':92C 'manipul':112C 'might':131C 'public':128C 'remot':124C 'unknown':100C 'use':133C 'vulner':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T09:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129444","severity":null,"published_at":"2026-11-15T09:16:44+00:00","modified_at":"2026-11-15T09:16:44+00:00","first_seen_at":"2026-11-15T09:34:41+00:00","fetched_at":"2026-11-15T09:34:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129444:4030","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10414","severity":null,"published_at":"2026-11-15T09:35:36+00:00","modified_at":"2026-11-15T09:35:36+00:00","first_seen_at":"2026-11-15T09:35:36+00:00","fetched_at":"2026-11-15T09:35:36+00:00","note":"Primary: D-Link has no fix: SAP10414 says DSL-6740C is EOL/EOS (Jan 2024), though that page covers a different CVE. VulDB (VDB-437457) says PoC on GitHub (link not visible, so not saved) and no exploitation in the wild is reported. Not verified: no vendor advisory for this CVE, so nothing marked verified. Open: FTP enabled by default unknown. Could not confirm the 20131126 build vs other firmware.","cites":["https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10414","https://vuldb.com/vuln/437457"]}],"documents":[{"id":162328,"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10414","title":"D-Link SAP10414: DSL-6740C EOL/EOS announcement","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":162329,"url":"https://vuldb.com/vuln/437457","title":"VulDB VDB-437457: DSL-6740C 20131126 ftpd_conf.php hard-coded credentials","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}