D-Link DCS-6501LH CVE-2026-125079

Exploitation requires network reachability to the camera's Media Service / ONVIF interface on a D-Link DCS-6501LH running firmware 3.03.02; the weakness is that ONVIF user credentials are hard-coded/derived from the pin_code value in /mnt/conf/SystemConfig.ini (functions pf_get_onvif_user_pwd and mydlink_default_sys_info), so no valid account is needed beforehand (PR:N, UI:N). Limiting factors: impact is confined to confidentiality (VC:L, VI:N, VA:N) - i.e., credential/information disclosure rather than direct device takeover; the device must be network-exposed to the attacker (typically behind NAT unless port-forwarded or on a reachable LAN); and the only published exploit artifact is an unverified evidence repository, so practical exploitation currently depends on reproducing the credential logic rather than running confirmed working code.

This is a hard-coded credentials flaw (CWE-798) in the Media Service of the D-Link DCS-6501LH network camera (firmware 3.03.02), where the pin_code argument handled by pf_get_onvif_user_pwd / mydlink_default_sys_info in /mnt/conf/SystemConfig.ini yields predictable ONVIF credentials. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) describes a remotely reachable, low-complexity, unauthenticated issue with only limited confidentiality impact and no integrity or availability impact, which matches the 6.9 base score and the modest E:P (proof-of-concept) exploit maturity. Real-world priority signals are mixed and lean moderate: the vuln.today Decision label is this_month (not act_now or emergency), the exploit maturity is only E:P, and the single exploit reference is a GitHub 'evidence' repository that is explicitly not verified as working exploit code. No EPSS score is provided in the input, so widespread-exploitation probability cannot be quantified here, and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. The confidentiality-only impact (VC:L) tempers the practical severity: this exposes credentials rather than directly granting code execution, though recovered ONVIF credentials could then be used to access the camera's media/management interface, which is a meaningful downstream risk for an internet-exposed device. Net: a real but moderate, this-month-tier issue rather than a drop-everything emergency, with the caveat that hard-coded credentials in IoT cameras are historically attractive to automated internet scanning once working code appears.

A remote attacker who can reach the camera's Media Service over the network derives or retrieves the hard-coded ONVIF credentials that are generated from the pin_code value stored in /mnt/conf/SystemConfig.ini, then authenticates to the camera's ONVIF/media interface as a legitimate user. A public PoC reference exists (a GitHub evidence repository) but it is not verified as working exploit code, so exploitation currently requires reproducing the credential-derivation logic rather than running a confirmed turnkey exploit. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no prior authentication or user interaction is needed against a reachable device.