PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10045 Shenzhen Kangda Xin Intelligent Network Technology Co., Ltd CVE debrief

The Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash, inspect active connections, and view currently connected devices. The CVSS score for this vulnerability is 9.8, indicating a critical severity.

Vendor
Shenzhen Kangda Xin Intelligent Network Technology Co., Ltd
Product
DR300
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-09
Advisory published
2026-06-09
Advisory updated
2026-06-09

Who should care

Administrators and users of the Shenzhen Kangda Xin Intelligent Network Technology Company's DR300 router, version 2.1.2.121, should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

The vulnerability is caused by hardcoded login credentials and telnet being enabled by default on WAN and LAN interfaces. This allows attackers to perform various malicious activities, including reading and writing to memory, modifying firmware, inspecting active connections, and viewing connected devices.

Defensive priority

critical

Recommended defensive actions

  • Immediately update the router firmware to a version that addresses these vulnerabilities, if available.
  • Disable telnet on WAN and LAN interfaces, and consider replacing it with a more secure protocol.
  • Change all default login credentials and ensure strong passwords are used.
  • Limit access to the router's management interface to trusted IP addresses and networks.
  • Regularly monitor the router's logs and network activity for suspicious behavior.

Evidence notes

The vulnerability was reported by Rubenabreu and is documented in the CVE-2026-10045 record on CVE.org and the NVD detail page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10045 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10045

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10045 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10045

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.