External risk intelligence

D-Link DSL-6740C FTP Hard-coded Credentials Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-129444

The vulnerability affects the FTP daemon on a D-Link DSL-6740C residential gateway device. While these devices are designed to reside at the network edge, FTP is not typically intended for public internet exposure. However, because this is an edge networking device and management/service interfaces are frequently exposed or misconfigured in such deployments, there is a high likelihood of reaching the service.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the FTP Daemon component of certain D-Link devices. This issue could allow for hard-coded credentials to be manipulated, potentially leading to unauthorized access. The vulnerability is publicly known and exploitable remotely, necessitating an assessment of its relevance to our environment.

Hard-coded credentials exposed via FTP Daemon.
Remote exploitation is possible with public exploit code.
Confirm relevance and exposure in our network.

Attack Path

How an attacker could exploit the issue

An attacker can remotely exploit this vulnerability without needing any credentials by targeting the FTP daemon. The attacker would interact with a vulnerable device to trigger a function within the `/etc/templates/ftpd/ftpd_conf.php` file. Successful exploitation could lead to the establishment of hard-coded credentials.

Remote access to the network is required.
An unknown function in `ftpd_conf.php` is triggered.
Enables hard-coded credentials for attackers.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could expose hard-coded FTP credentials through an unknown function in the FTP daemon's configuration file. When supported by the advisory, remote attackers could leverage publicly available exploits to access these credentials, potentially impacting the security of the affected device and its network.

System credentials could be exposed.
Remote attackers may exploit publicly available code.
Unauthorized access to network resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects D-Link DSL-6740C devices, likely managed by infrastructure or network operations teams. The first practical step is to identify all instances of this device, determine their network exposure, and confirm their business criticality. Once ownership is established, a remediation plan can be developed based on the assessed risk.

Identify and assign ownership for devices.
Verify network reachability and criticality.
Plan coordinated vendor and remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DSL-6740C?

The D-Link DSL-6740C is a residential gateway device. These products typically act as a bridge between a local home or small office network and the internet service provider. They manage network traffic and provide essential connectivity services, such as the FTP daemon, which allows for file transfers within the device environment.

What does CVE-2026-129444 mean?

This CVE identifies a security weakness involving hard-coded credentials, categorized as CWE-259 and CWE-798. Essentially, the software contains built-in authentication secrets that cannot be changed by the user. If an attacker knows or discovers these credentials, they can bypass standard login protections to gain unauthorized access to the device's functions.

How is this vulnerability triggered?

An attacker triggers this issue by interacting with a specific function within the device's ftpd_conf.php configuration file. While remote access is a requirement, the vulnerability does not require the attacker to have pre-existing credentials to begin the exploit process. Simply interacting with the FTP daemon interface is sufficient to manipulate the configuration.

Do I need to worry about this if my device is internal?

Halo Surface Signal notes that while the FTP daemon is generally not intended for public internet exposure, this device resides at the network edge. Because management interfaces on edge devices are often misconfigured, there is a likely chance of remote accessibility. Even if not directly on the internet, any service reachable from your network perimeter is a point of concern.

How should I respond to this threat?

Start by identifying all D-Link DSL-6740C units in your environment and confirming their specific network placement. Once you have a list, evaluate whether these devices are reachable from the public internet or untrusted segments. Finally, coordinate with your network operations team to assess the business risk and prepare a strategy for securing or replacing the affected hardware.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.