CVE-2026-113735: D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlinksetrootpwd of the file /mnt/mtd/aoniipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The affected product and version identified are D-Link DCS-6501LH running version 3.03.02. The provided data does not establish whether earlier or later versions are affected.
Can this be exploited remotely, and does an attacker need an account?
The attack may be launched remotely, and the vector indicates no privileges are required. Exploitation is assessed as high complexity and difficult, however, and a public exploit has been disclosed.
What is the expected impact if exploitation succeeds?
The reported impact is limited to confidentiality. No integrity or availability impact is indicated by the supplied severity vector.