Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-129444: D-Link DSL-6740C FTP service uses fixed login
CVE-2026-129444 · published today
Summary
The FTP component of the D-Link DSL-6740C router contains a username and password that are built into the software and cannot be changed. Because the credentials are known, anyone on the internet can access the FTP service and potentially view or modify files on the router. Update the router firmware to a version that removes the hard‑coded login or replace the device with a model that does not have this weakness.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| d-link | dsl-6740c | 20131126 |
Original advisory text
D-Link DSL-6740C FTP Daemon ftpd_conf.php hard-coded credentials
A vulnerability was identified in D-Link DSL-6740C 20131126. This affects an unknown function of the file /etc/templates/ftpd/ftpd_conf.php of the component FTP Daemon. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used.
References
- https://vuldb.com/vuln/437457 vdb-entry
- https://vuldb.com/vuln/437457/cti signature permissions-required
- https://vuldb.com/cve/CVE-2026-129444 third-party-advisory
- https://vuldb.com/submit/1044943 third-party-advisory
- https://github.com/XueDugu/dlink-dsl6740c-ftp-default-evidence exploit
- https://www.dlink.com/ product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-798Use of Hard-coded Credentials
CWE-259Use of Hard-coded Password
Timeline
Published15 Nov 2026
Updated15 Nov 2026
First seen15 Nov 2026
Track software like this
Free during beta