---
id: "CVE-2026-129445"
page: "https://infrastack.ai/live/CVE-2026-129445"
kind: "vulnerability"
aliases: ["CVE-2026-129445"]
title: "D-Link DIR-850L router: hard-coded console credentials let local attackers log in"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "DIR-850L", "fixed": [], "affected": "FW1.20WWb03 (Rev.A per submitter)", "ecosystem": "firmware"}]
ecosystems: []
tags: ["d-link", "dir-850l", "end-of-life", "firmware", "home-networks", "infrastructure", "routers"]
not_affected_if: ["no-local-access", "other-firmware-versions"]
published_at: "2026-11-15T10:16:53+00:00"
first_seen_at: "2026-11-15T10:34:26+00:00"
updated_at: "2026-11-15T10:36:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129445", "first_seen_at": "2026-11-15T10:34:26+00:00"}, {"source": "analyst", "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10277", "first_seen_at": "2026-11-15T10:36:29+00:00", "cites": ["https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10277", "https://vuldb.com/vuln/437458"]}]
exploit_sources: []
---

# D-Link DIR-850L router: hard-coded console credentials let local attackers log in

Link for people: https://infrastack.ai/live/CVE-2026-129445 (this .md is for agents)

The D-Link DIR-850L firmware FW1.20WWb03 ships hard-coded credentials in the console login component at /usr/sbin/consolepwd. A local attacker who knows them can log in to the device console and gain control of the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:DIR-850L affected FW1.20WWb03 (Rev.A per submitter) fixed no fixed version listed

## How to check

- Open the router admin page and read the firmware version; FW1.20WWb03 is the one named.
- With shell access, look for /usr/sbin/consolepwd.
- Other DIR-850L firmware versions are not named in any source. Treat them as unconfirmed, not as safe.

## Fix

No fix. D-Link's page SAP10277 says all DIR-850L hardware revisions reached end of life on March 1, 2020 and recommends retiring and replacing them. VulDB lists no countermeasure.

## Timeline

- 2026-11-15T10:34:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129445
- 2026-11-15T10:36:29+00:00 analyst https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10277 — VulDB entry (CNA) names FW1.20WWb03, local access, a proof of concept at github.com (no link given, not saved), status Confirmed. D-Link SAP10277 says DIR-850L is EOL since 2020-03-01, so no fix expected. No D-Link page for this CVE found. Nothing marked verified. CVSS 4.0 vector shows PR:H.

## Documents

- [advisory] D-Link SAP10277: DIR-850L all revisions EOL/EOS https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10277
- [describes] VulDB VDB-437458: D-Link DIR-850L FW1.20WWb03 consolepwd hard-coded credentials https://vuldb.com/vuln/437458

## From the sources

A security flaw has been discovered in D-Link DIR-850L FW1.20WWb03. This impacts an unknown function of the file /usr/sbin/consolepwd of the component Console Login. Performing a manipulation results in hard-coded credentials. The attack requires a local approach. The exploit has been released to the public and may be used for attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_