D-Link DSL-6740C firmware version 20131126 reportedly has a critical flaw in its FTP daemon: hard-coded credentials. VulDB, the CNA, says the flaw can be exploited remotely without authentication. The CVE description also states that an exploit is publicly available, though this brief has not independently verified that the exploit works.
What Is It
CVE-2026-129444 is a hard-coded credentials flaw in the FTP Daemon of the D-Link DSL-6740C. VulDB, the CNA, places the issue in an unknown function of the file /etc/templates/ftpd/ftpd_conf.php. Two weaknesses are listed: CWE-259 (Use of Hard-coded Password) and CWE-798 (Use of Hard-coded Credentials).
The CNA scored it 10.0 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It also scored 9.3 CRITICAL under CVSS 4.0 and 10.0 under CVSS 2.0. NVD published the record on 2026-11-15 with the status "Deferred."
Why It Matters
The CNA's scoring describes a bug that would be easy to exploit at scale. The vector rates it as attackable over the network with low complexity, needing no privileges and no user action. Confidentiality, integrity and availability impacts are all rated high, and the CVSS 3.1 scope is "changed." These ratings come from the CNA's assessment. NVD has not independently scored the issue.
According to the CVE description, "the exploit is publicly available and might be used." The CVSS 4.0 vector agrees, with exploit maturity set to Proof-of-Concept (E:P). The references link to a public GitHub repository labeled as evidence of the issue. Its contents and reliability as a working exploit have not been independently confirmed for this brief.
KEV status: At the time of writing, CVE-2026-129444 does not appear in the CISA Known Exploited Vulnerabilities (KEV) Catalog, so CISA has not confirmed active exploitation. Still, a reported public proof-of-concept and a maximum CNA-assigned CVSS score make it a high priority for anyone running this device.
What's Vulnerable
- Vendor: D-Link
- Product: DSL-6740C
- Component: FTP Daemon
- Affected version: 20131126
- CPE:
cpe:2.3:h:d-link:dsl-6740c:*:*:*:*:*:*:*:*
The supplied data lists no other affected versions.
Patch Status
The supplied NVD record does not mention a vendor patch, fixed firmware version or D-Link security advisory. Its only D-Link reference is the vendor homepage. Because the CVE is not listed in the CISA KEV Catalog, there is no CISA required action or due date.
Owners of DSL-6740C devices running firmware 20131126 should check D-Link's site for updates or end-of-life notices. The data supplied for this brief confirms neither.