CVE-2026-125079: D-Link DCS-6501LH Media Service SystemConfig.ini mydlink_default_sys_info hard-coded credentials

Published Nov 10, 2026

Updated

A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pfgetonvifuserpwd/mydlinkdefaultsysinfo of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pincode causes hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected Software

1 affected component

D-Link DCS-6501LH=3.03.02

Event History

Nov 10, 2026

CVE Published

via MITRE·12:15 AM

Data Sourced

via MITRE·12:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are known to be affected?

The affected product and version identified are D-Link DCS-6501LH devices running version 3.03.02. The issue is in the Media Service's handling of SystemConfig.ini.

Can this be exploited remotely without prior access?

Yes. The vulnerability can be initiated remotely, and the listed vector indicates no privileges or user interaction are required.

Is public exploit information available?

Yes. A proof of concept is flagged, and the vulnerability information states that the exploit has been publicly disclosed and may be used.