CVE-2026-113735 in DCS-6501LH
Summary
by MITRE • 10/21/2026
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The D-Link DCS-6501LH network camera running firmware version 3.03.02 contains a critical authentication flaw within its embedded web server implementation, specifically located in the mydlink_set_root_pwd function found in the /mnt/mtd/aoni_ipc binary component. This vulnerability stems from an improper validation of password complexity requirements during the user credential update process. When an administrator or authorized user attempts to change the root account password through the device's management interface, the system fails to enforce strong cryptographic standards or minimum entropy thresholds for the new credentials. Consequently, this allows attackers to set passwords that are trivially guessable or susceptible to brute-force attacks, effectively bypassing intended security controls and reducing the authentication barrier significantly.
From a technical perspective, this flaw is classified under CWE-521, which denotes weak password requirements, and aligns with MITRE ATT&CK technique T1078, specifically valid accounts used for initial access or persistence. The vulnerability enables an attacker to manipulate the configuration state of the device by submitting crafted HTTP requests that trigger the vulnerable function without triggering appropriate validation logic. Although the exploitation requires a high level of complexity due to potential network segmentation requirements and specific timing constraints associated with interacting with the embedded web server, the existence of publicly disclosed exploits means that automated tools or scripts are available for threat actors who possess sufficient technical expertise. This public disclosure significantly lowers the barrier to entry for opportunistic attackers scanning for vulnerable IoT devices on the internet.
The operational impact of this vulnerability is severe, as it compromises the integrity and confidentiality of the surveillance system. By establishing weak credentials, an attacker can gain persistent access to the camera's live video feed, potentially exposing sensitive visual data from private or restricted areas. Furthermore, once authenticated with root-level privileges obtained through weak passwords, the attacker may attempt further exploitation such as installing malware, pivoting to other devices on the local network via lateral movement, or using the compromised device for distributed denial-of-service attacks in botnet formations. The remote nature of this attack vector means that no physical access is required, making it a persistent threat even if the camera is installed in hard-to-reach locations.
Mitigation strategies must focus on immediate remediation and long-term security hygiene. Users should immediately update their firmware to the latest version provided by D-Link, which likely includes patches for this authentication bypass flaw. In cases where updating is not feasible due to hardware end-of-life status or supply chain constraints, administrators should enforce strong password policies through external access control lists if supported, and ensure that remote management interfaces are disabled unless absolutely necessary. Network segmentation using VLANs can also limit the blast radius by isolating IoT devices from critical corporate infrastructure. Regular vulnerability scanning of network assets is recommended to detect any instances where weak credentials have been configured or exploited.