PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113735 D-Link CVE debrief

A vulnerability was determined in D-Link DCS-6501LH 3.03.02, affecting the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc, which can lead to the use of weak credentials. The attack may be launched remotely with high complexity. The exploit has been publicly disclosed and may be utilized. Defenders managing D-Link DCS-6501LH devices should assess exposure and prioritize verification and potential updates. The vulnerability affects D-Link DCS-6501LH version 3.03.02, specifically the mydlink_set_root_pwd function in /mnt/mtd/aoni_ipc, leading to weak credentials. Remote attackers can exploit this with high complexity. The vulnerability was determined in D-Link DCS-6501LH

Vendor
D-Link
Product
DCS-6501LH
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-21
Advisory published
2026-10-20
Advisory updated
2026-10-21

Who should care

Defenders managing D-Link DCS-6501LH devices, especially those with version 3.03.02, should assess exposure and prioritize verification and potential updates. Defenders need to verify device integrity to prevent potential unauthorized access. Updating to a fixed version is crucial if available. Monitoring for exploit utilization is necessary. Defenders should prioritize verifying the integrity of D-Link DCS-6501LH devices, especially those with version 3.0

Why it matters

CVE-2026-113735 is a vulnerability in D-Link DCS-6501LH version 3.03.02 that can lead to weak credentials, allowing remote attackers to potentially gain unauthorized access with high complexity.

  • Defenders need to verify device integrity to prevent potential unauthorized access.
  • Updating to a fixed version is crucial if available.
  • Monitoring for exploit utilization is necessary.

Technical summary

The vulnerability affects D-Link DCS-6501LH version 3.03.02, specifically the mydlink_set_root_pwd function in /mnt/mtd/aoni_ipc, leading to weak credentials. Remote attackers can exploit this with high complexity. The vulnerability was determined in D-Link DCS-6501LH version 3.03.02. The function mydlink_set_root_pwd in the file /mnt/mtd/aoni_ipc is affected, leading to weak credentials. The attack requires remote access and has high complexity. Public disclosure of the exploit exists. Defenders should prioritize verifying the integrity of D-Link DCS-6501LH devices, especially those with version 3.03.02, and consider updating to a fixed version if available.

Defensive priority

Defenders should prioritize verifying the integrity of D-Link DCS-6501LH devices, especially those with version 3.03.02, and consider updating to a fixed version if available.

Recommended defensive actions

  • Verify the integrity of D-Link DCS-6501LH devices, especially those with version 3.03.02.
  • Consider updating to a fixed version if available.
  • Monitor for public exploit utilization.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was determined in D-Link DCS-6501LH version 3.03.02. The function mydlink_set_root_pwd in the file /mnt/mtd/aoni_ipc is affected, leading to weak credentials. The attack requires remote access and has high complexity. Public disclosure of the exploit exists.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113735 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113735

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113735 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113735

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113735.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/422885

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/422885/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-113735

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/1015788

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/XueDugu/dlink-dcs6501lh-predictable-telnet-root-evidence

    Supplemental source - related

  • Source reference

    Unverified legacy reference

    URL: https://github.com/XueDugu/dlink-dcs6501lh-predictable-telnet-root-evidence/tree/main/poc

    Supplemental source - exploit

  • Source reference

    Unverified legacy reference

    URL: https://www.dlink.com/

    Supplemental source - broken-link, product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.