#VU109806 Use of hard-coded credentials in DIR-605L and DIR-816L
Published: May 26, 2025
Vulnerability identifier: #VU109806
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
DIR-605L
DIR-816L
DIR-605L
DIR-816L
Software vendor:
D-Link
D-Link
Description
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials via telnet.
Successful exploitation of this vulnerability requires that the device is not registered at mydlink.com.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
The affected products have reached their end of life status and are no longer supported by the vendor.