| Título | D-Link DSL-6740C ADSL2+ router (Rev.A) S5 and N5, TR069 builds dated 20131126 Hard-coded Credentials |
|---|
| Descripción | The D-Link DSL-6740C firmware starts the vendor FTP daemon in the default boot chain. /etc/scripts/system.sh runs "/etc/templates/ftpd.sh start"; the original template etc/templates/ftpd/ftpd_conf.php writes a fixed account into /var/etc/ftpd.conf:
fwrite2($filename, "user=anonymous\t*\t /\t 5 -\n");
fwrite2($filename, "user=test test / 5 A\n");
The generated configuration therefore contains "user=test test / 5 A" (the flag A grants every FTP operation, including upload, overwrite and erase). The vendor ftpd listens on x.x.x.x:21 without a source restriction. Every unit using these builds accepts test/test, and the account is not affected by changing the Web administrator password.
Verified and confirmed: test/test logs in successfully (banner "220 Welcome to ALPHA_WIAD -FTPd server.", USER 331, PASS 230 "User test logged in.", PWD "/"), while an incorrect password is rejected with "532 Login incorrect.". The result was confirmed on both shipped Rev.A samples, S5 and N5.
This is CWE-798 (Use of Hard-coded Credentials), CWE-1391 (Use of Weak Credentials) and CWE-1188 (Insecure Default Initialization of Resource).
CVSS 3.1: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|---|
| Usuario | BenSmith (UID 102206) |
|---|
| Sumisión | 2026-10-20 07:23 (hace 26 días) |
|---|
| Moderación | 2026-11-14 17:58 (25 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 437457 [D-Link DSL-6740C 20131126 FTP Daemon ftpd_conf.php autenticación débil] |
|---|
| Puntos | 20 |
|---|