{"id":"CVE-2026-129445","kind":"vulnerability","aliases":["CVE-2026-129445"],"related":[],"title":"D-Link DIR-850L router: hard-coded console credentials let local attackers log in","description":"A security flaw has been discovered in D-Link DIR-850L FW1.20WWb03. This impacts an unknown function of the file /usr/sbin/consolepwd of the component Console Login. Performing a manipulation results in hard-coded credentials. The attack requires a local approach. The exploit has been released to the public and may be used for attacks.","summary":"The D-Link DIR-850L firmware FW1.20WWb03 ships hard-coded credentials in the console login component at /usr/sbin/consolepwd. A local attacker who knows them can log in to the device console and gain control of the router.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DIR-850L","fixed":[],"affected":"FW1.20WWb03 (Rev.A per submitter)","ecosystem":"firmware"}],"ecosystems":[],"tags":["d-link","dir-850l","end-of-life","firmware","home-networks","infrastructure","routers"],"not_affected_if":["no-local-access","other-firmware-versions"],"how_to_check":"- Open the router admin page and read the firmware version; FW1.20WWb03 is the one named.\n- With shell access, look for /usr/sbin/consolepwd.\n- Other DIR-850L firmware versions are not named in any source. Treat them as unconfirmed, not as safe.","fix":"No fix. D-Link's page SAP10277 says all DIR-850L hardware revisions reached end of life on March 1, 2020 and recommends retiring and replacing them. VulDB lists no countermeasure.","status":"open","published_at":"2026-11-15T10:16:53+00:00","first_seen_at":"2026-11-15T10:34:26+00:00","triaged_at":"2026-11-15T10:35:25+00:00","updated_at":"2026-11-15T10:36:29+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-15T10:35:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"D-Link DIR-850L router: hard-coded console credentials let local attackers log in","impact":"high","summary":"The D-Link DIR-850L firmware FW1.20WWb03 ships hard-coded credentials in the console login component at /usr/sbin/consolepwd. A local attacker who knows them can log in to the device console and gain control of the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["d-link","dir-850l","routers","firmware","home-networks"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker logs in with hard-coded credentials and takes control","analyst_note":"Confirm the affected firmware range and any D-Link fix from the NVD entry or D-Link's advisory; the public exploit is noted but no source links it.","how_to_check":"- Check the firmware version on the router's admin page and compare with `FW1.20WWb03`\n- Look for the file `/usr/sbin/consolepwd` on the device if you have shell access\n- unknown for other checks, the sources do not say","plain_action":"If you own a D-Link DIR-850L router, check its firmware version and watch for an update from D-Link; the sources do not name a fixed version.","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","no-local-access"],"who_is_affected":"Owners of D-Link DIR-850L routers running firmware FW1.20WWb03 are exposed. The attack requires local access, so the risk is highest on networks where untrusted people can reach the device or its console. unknown whether other firmware versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4557,"output_tokens":626,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected firmware range and any D-Link fix from the NVD entry or D-Link's advisory; the public exploit is noted but no source links it.","search":"'-129445':19A,22A '-2026':18A,21A '/usr/sbin/consolepwd':62B,104C '850l':6A,25A,31B,48B,94C 'approach':124C 'attack':15A,65B,120C,138C 'code':10A,54B,117C 'compon':60B,107C 'consol':11A,58B,75B,108C 'control':78B 'credenti':12A,55B,118C 'cve':17A,20A 'd':2A,27B,44B,90C 'd-link':1A,26B,43B,89C 'devic':74B 'dir':5A,24A,30B,47B,93C 'dir-850l':4A,23A,29B,46B,92C 'discov':87C 'end':33B 'end-of-lif':32B 'exploit':126C 'file':103C 'firmwar':36B,49B 'flaw':84C 'function':100C 'fw1.20wwb03':50B,95C 'gain':77B 'hard':9A,53B,116C 'hard-cod':8A,52B,115C 'home':38B 'home-network':37B 'impact':97C 'infrastructur':40B 'know':67B 'let':13A 'life':35B 'link':3A,28B,45B,91C 'local':14A,64B,123C 'log':16A,70B 'login':59B,109C 'manipul':112C 'may':134C 'network':39B 'perform':110C 'public':132C 'releas':129C 'requir':121C 'result':113C 'router':7A,41B,81B 'secur':83C 'ship':51B 'unknown':99C 'use':136C","nicknames":[],"mitigations":[],"who_affected":"DIR-850L routers (Rev.A per the submitter) running firmware FW1.20WWb03 are the confirmed affected version. The attack needs local access and an existing login, so the risk is highest where untrusted people can reach the router console. The router is end of life and D-Link will not patch it. Owners of other firmware versions should not assume they are safe, but no source names them.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a D-Link DIR-850L router, plan to replace it with a model D-Link still supports, because D-Link no longer updates it.","pkeys":["dir850l"],"ptokens":["850l","dir"],"labels":["dir850l","dlink","endoflife","firmware","high","homenetworks","infrastructure","routers"],"campaign_type":null,"search_a":"'-129445':19A,22A '-2026':18A,21A '850l':6A,25A 'attack':15A 'code':10A 'consol':11A 'credenti':12A 'cve':17A,20A 'd':2A 'd-link':1A 'dir':5A,24A 'dir-850l':4A,23A 'hard':9A 'hard-cod':8A 'let':13A 'link':3A 'local':14A 'log':16A 'router':7A","search_b":"'/usr/sbin/consolepwd':62B '850l':31B,48B 'attack':65B 'code':54B 'compon':60B 'consol':58B,75B 'control':78B 'credenti':55B 'd':27B,44B 'd-link':26B,43B 'devic':74B 'dir':30B,47B 'dir-850l':29B,46B 'end':33B 'end-of-lif':32B 'firmwar':36B,49B 'fw1.20wwb03':50B 'gain':77B 'hard':53B 'hard-cod':52B 'home':38B 'home-network':37B 'infrastructur':40B 'know':67B 'life':35B 'link':28B,45B 'local':64B 'log':70B 'login':59B 'network':39B 'router':41B,81B 'ship':51B","search_c":"'/usr/sbin/consolepwd':104C '850l':94C 'approach':124C 'attack':120C,138C 'code':117C 'compon':107C 'consol':108C 'credenti':118C 'd':90C 'd-link':89C 'dir':93C 'dir-850l':92C 'discov':87C 'exploit':126C 'file':103C 'flaw':84C 'function':100C 'fw1.20wwb03':95C 'hard':116C 'hard-cod':115C 'impact':97C 'link':91C 'local':123C 'login':109C 'manipul':112C 'may':134C 'perform':110C 'public':132C 'releas':129C 'requir':121C 'result':113C 'secur':83C 'unknown':99C 'use':136C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129445","severity":null,"published_at":"2026-11-15T10:16:53+00:00","modified_at":"2026-11-15T10:16:54+00:00","first_seen_at":"2026-11-15T10:34:26+00:00","fetched_at":"2026-11-15T10:34:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129445:4033","url":"https://vuldb.com/vuln/437458","severity":null,"published_at":"2026-11-15T10:36:29+00:00","modified_at":"2026-11-15T10:36:29+00:00","first_seen_at":"2026-11-15T10:36:29+00:00","fetched_at":"2026-11-15T10:36:29+00:00","note":"VulDB entry (CNA) names FW1.20WWb03, local access, a proof of concept at github.com (no link given, not saved), status Confirmed. D-Link SAP10277 says DIR-850L is EOL since 2020-03-01, so no fix expected. No D-Link page for this CVE found. Nothing marked verified. CVSS 4.0 vector shows PR:H.","cites":["https://vuldb.com/vuln/437458","https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10277"]}],"documents":[{"id":162631,"url":"https://vuldb.com/vuln/437458","title":"VulDB VDB-437458: D-Link DIR-850L FW1.20WWb03 consolepwd hard-coded credentials","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":162632,"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10277","title":"D-Link SAP10277: DIR-850L all revisions EOL/EOS","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}