Dcs 6501Lh
Monthly
Hard-coded/derived ONVIF credentials in the Media Service of the D-Link DCS-6501LH network camera (firmware 3.03.02) allow remote attackers to obtain predictable device credentials without any prior account, since the pin_code argument handled by pf_get_onvif_user_pwd and mydlink_default_sys_info in /mnt/conf/SystemConfig.ini determines the ONVIF user password. Impact is limited to confidentiality (credential/information disclosure) rather than direct device takeover, and exploitation requires network reachability to the camera's Media Service/ONVIF interface, which is typically behind NAT unless port-forwarded or on the same LAN. A public PoC reference (an evidence repository) exists but is not verified as working exploit code, and no KEV listing or confirmed active exploitation is reported; EPSS/KEV-based prioritization places this in the 'this_month' remediation window.
Hard-coded/derived ONVIF credentials in the Media Service of the D-Link DCS-6501LH network camera (firmware 3.03.02) allow remote attackers to obtain predictable device credentials without any prior account, since the pin_code argument handled by pf_get_onvif_user_pwd and mydlink_default_sys_info in /mnt/conf/SystemConfig.ini determines the ONVIF user password. Impact is limited to confidentiality (credential/information disclosure) rather than direct device takeover, and exploitation requires network reachability to the camera's Media Service/ONVIF interface, which is typically behind NAT unless port-forwarded or on the same LAN. A public PoC reference (an evidence repository) exists but is not verified as working exploit code, and no KEV listing or confirmed active exploitation is reported; EPSS/KEV-based prioritization places this in the 'this_month' remediation window.