CVE-2026-129444 in DSL-6740C
Summary
by MITRE • 11/15/2026
A vulnerability was identified in D-Link DSL-6740C 20131126. This affects an unknown function of the file /etc/templates/ftpd/ftpd_conf.php of the component FTP Daemon. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/15/2026
The vulnerability identified in D-Link DSL-6740C firmware version 20131126 represents a critical security flaw within the device's FTP Daemon component, specifically affecting the configuration file located at /etc/templates/ftpd/ftpd_conf.php. This issue stems from improper handling of credential management during the initialization or processing of FTP service configurations. Instead of dynamically generating secure credentials or properly validating user inputs against a secure database, the system relies on hard-coded default values that are exposed through this specific configuration file manipulation. The presence of these static credentials means that any attacker who can interact with the affected function gains immediate access to valid authentication tokens without needing to perform complex password cracking or brute-force attacks. This flaw fundamentally undermines the confidentiality and integrity guarantees expected from secure network devices, as it allows unauthorized entities to bypass standard authentication mechanisms entirely.
From a technical perspective, this vulnerability is classified under CWE-798: Use of Hard-coded Credentials, which describes situations where software contains fixed authentication data that cannot be changed by users or administrators. The attack vector for this flaw is remote, meaning an adversary does not need physical access to the device nor prior network-level privileges to exploit it. By sending specifically crafted requests to the FTP daemon interface, a threat actor can trigger the function responsible for loading ftpd_conf.php in a manner that reveals or utilizes these embedded credentials. The fact that public exploits are available significantly lowers the barrier to entry for attackers, enabling automated scanning tools and opportunistic adversaries to compromise vulnerable devices with minimal effort. This aligns closely with MITRE ATT&CK technique T1078: Valid Accounts, where attackers leverage legitimate system accounts to maintain persistent access or escalate privileges within the network environment.
The operational impact of this vulnerability is severe, particularly given that DSL-6740C is a residential gateway often deployed in home and small business networks with limited security awareness among end-users. Compromise via hard-coded credentials allows an attacker to gain full control over the FTP service, which may be linked to broader device management functions or file storage capabilities accessible from within the local network. An adversary could use this access to exfiltrate sensitive data stored on the device, modify configuration files to redirect traffic through malicious servers, or install persistent backdoors for long-term surveillance and command-and-control operations. Furthermore, because residential gateways often serve as the primary gateway between a private LAN and the public internet, compromising one such device can facilitate lateral movement into internal networks where more valuable assets reside. The availability of public exploits exacerbates this risk by increasing the likelihood of widespread automated attacks targeting unpatched devices across the internet.
Mitigation strategies for this vulnerability must prioritize immediate remediation through firmware updates provided by D-Link that address the credential handling logic in the FTP daemon configuration process. Administrators should ensure their DSL-6740C units are running a patched version where hard-coded credentials have been replaced with dynamic, user-defined authentication mechanisms or disabled entirely if FTP access is not required. In cases where updating firmware is not immediately feasible, network segmentation and firewall rules can be employed to restrict access to the management interfaces of these devices from untrusted networks. Additionally, disabling unnecessary services such as FTP reduces the attack surface available to potential adversaries. Continuous monitoring for anomalous login attempts or unusual outbound traffic patterns associated with compromised gateways can also aid in early detection of exploitation activities. Ultimately, adhering to industry best practices for IoT security, including regular patch management and strict access controls, is essential to mitigating risks posed by vulnerabilities like this one that rely on fundamental design flaws such as hard-coded credentials.