Bensmith

A security flaw in the Console Login component allows a local attacker to obtain hard-coded credentials by manipulating the `/usr/sbin/consolepwd` file.

A remote issue exists in the FTP Daemon component within the file `/etc/templates/ftpd/ftpd conf.php`. Manipulation of an unknown function in this file allows for the exposure of hard-coded credentials.

A remote attack is possible via the emDaemon MQTT Broker component. The issue resides in the `system` function within the `/etc/emDaemon/mosquitto.conf` file, which allows for the use of hard-coded credentials.

The Media Service component contains hard-coded credentials. Specifically, the `pf get onvif user pwd()` and `mydlink default sys info()` functions within the `/mnt/conf/SystemConfig.ini` file use a predefined admin username and password (174250). A remote attacker can manipulate the `pin code` argument to gain unauthorized access to protected information.