D-Link DCS-6501LH CVE-2026-113735

Exploitation requires that the target D-Link DCS-6501LH (firmware 3.03.02) exposes the network/telnet service reachable by the attacker, and that the attacker can reproduce the weak/predictable root credential produced by the mydlink_set_root_pwd function in /mnt/mtd/aoni_ipc. Per the CVSS vector (PR:N/UI:N) no prior authentication or user interaction is needed, but the dominant limiting factor is AC:H - the attack is explicitly described as high-complexity and 'difficult,' meaning the attacker must successfully derive the predictable credential rather than simply connecting. Scope is limited to this specific camera model and firmware version.

Signals point to a LOW real-world priority. The vendor CVSS 4.0 score is 2.9 (Low) with AV:N/AC:H/PR:N/UI:N and only VC:L impact, and the description explicitly states the attack 'requires a high level of complexity' and 'appears to be difficult.' This is NOT in CISA KEV (no confirmed active exploitation) and no EPSS score was provided in the input, so widespread exploitation cannot be inferred. The one elevating signal is that public exploit/PoC code exists (GitHub repo 'dlink-dcs6501lh-predictable-telnet-root-evidence'), but PoC availability is distinct from active exploitation. There is an important CONFLICT between the vendor framing and the likely real impact: the flaw is in mydlink_set_root_pwd and the PoC concerns a PREDICTABLE TELNET ROOT password (CWE-1391, weak credentials). If an attacker can reliably predict that root credential, the practical outcome is full root access to the camera - far more severe than the vendor's VC:L / 'Information Disclosure' tag implies. The high attack complexity (deriving/predicting the credential) is the main mitigant keeping real risk low; verify the exact impact with D-Link, as the vendor's Low rating and the PoC's root-telnet claim do not fully agree.

A remote attacker on the network predicts or derives the weak root password generated by the mydlink_set_root_pwd routine and uses it to authenticate to the camera's telnet service as root. Public PoC/evidence code exists (GitHub) demonstrating the predictable-credential weakness, but exploitation is rated high-complexity and difficult, so success depends on the attacker reproducing the credential-derivation logic.