| Title | D-Link DCS-6501LH network camera Firmware DCS6501LHCx_FW303B02_SD.zip, application version V3.03.02 Predictable Password |
|---|
| Description | The D-Link DCS-6501LH derives the root account password from public device attributes instead of a random device secret: root_password = MD5("<model>-" + uppercase(MAC))[0:8], with model = DCS-6501LH. The value is generated and written into the persistent account store during MAC provisioning by the vendor's own code inside /mnt/mtd/aoni_ipc (produst_set_mac_addr 0x4834e8 -> mydlink_set_dev_mac 0x4912bc -> mydlink_set_root_pwd 0x4911a8, which issues four shell commands taken verbatim from .rodata: echo -n "%s-%s" > /tmp/tmp_pwd; echo `md5sum ... | head -c 8` > /tmp/pwd; ... >> /tmp/pwd; passwd root < /tmp/pwd). At the same time the boot path starts the Telnet daemon unless a suppression file is present: mydlink_open_telnet (0x497180, called from pf_mydlink_init 0x497a2c) checks is_file_exist("/mnt/sd_card/telnet_open") and, when the file does not exist, runs socket_system("telnetd &"), i.e. Telnet is enabled by default and the flag file suppresses it. An attacker who can reach TCP/23 and knows (or observes) the device MAC address can compute the root password offline and log in as root without any secret. Both inputs are public: the model is fixed for the product, and the MAC is printed on the label, visible to any host on the same segment and readable from the device itself. Example: MAC 12:32:45:78:45:22 -> MD5("DCS-6501LH-12:32:45:78:45:22") = 7b4e9a9a67cfc3c4352bdedc399813d2 -> root password 7b4e9a9a.
Affected component and hashes:
/mnt/mtd/aoni_ipc sha256 8f010ddcdf27853e3048971e770611d5261b8caa5f53ce8e6b96393b54a2c559
rootfs/bin/busybox sha256 aa380fa2ed91caf2c8841c3121492754725ebb7e1df1eb6382d6ec0876f07200
package sha256 8751e1219ddfd839f59a3b01b2ecace2ecf3c9b95cc83f8278886bc87e0652c1
inner image sha256 fdaf265736eab61ec8b5e4849db6c75129cb5123bdb271603eab191f636b8471
download https://support.dlink.com/resource/PRODUCTS/DCS-6501LH/REVC/DCS6501LHCx_FW303B02_SD.zip
Verification. The vulnerability was verified. Running the four vendor-generated commands through the firmware BusyBox produced /mnt/conf/passwd = root:p5nfaUpna5nGw:20710:0:root:/root:/bin/sh, and crypt("7b4e9a9a","p5") equals "p5nfaUpna5nGw", i.e. the stored root password is the predicted value. The firmware BusyBox then executed the vendor command "telnetd &" and the firmware Telnet daemon listens on *:23. A real Telnet login with root / 7b4e9a9a passes the password check, while root / wrongpass123 returns "Login incorrect". Negative controls: a wrong password returns "Login incorrect", and the account store contains exactly crypt("7b4e9a9a") and not some other secret. The disassembly, the runtime record and the derivation/login PoC clients are published in the evidence repository linked below.
Impact. An attacker who can reach TCP/23 and knows the MAC address can log in as root with the derived password and obtain complete control of the device (configuration, firmware, audio/video, SD-card data). The derivation contains no random device secret, so the credential is recoverable offline by anyone with the firmware and is the same for every device that shares the same MAC. Direct WAN exploitation is not claimed.
Vendor coordination: reported to D-Link SIRT ([email protected]) on 2026-10-06. The DCS-6501LH is a current, supported D-Link model.
CWE-798: Use of Hard-coded Credentials
CWE-259: Use of Hard-coded Password
CWE-1391: Use of Weak Credentials
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS v3.1 (equivalent estimate): CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8) |
|---|
| User | XueDugu (UID 100263) |
|---|
| Submission | 10/06/2026 12:46 (14 days ago) |
|---|
| Moderation | 10/20/2026 18:11 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422885 [D-Link DCS-6501LH 3.03.02 /mnt/mtd/aoni_ipc mydlink_set_root_pwd weak credentials] |
|---|
| Points | 20 |
|---|