CVE-2026-125079

Name of the Vulnerable Software and Affected Versions D-Link DCS-6501LH version 3.03.02

Description The Media Service component contains hard-coded credentials. Specifically, the pf get onvif user pwd() and mydlink default sys info() functions within the /mnt/conf/SystemConfig.ini file use a predefined admin username and password (174250). A remote attacker can manipulate the pin code argument to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.