Field brief
CVE‑2026‑129444: Critical D‑Link DSL‑6740C FTP vulnerability remains unpatched
A critical CVE affecting D‑Link DSL‑6740C routers has no vendor advisory or patch yet, leaving a CVSS 10.0 flaw that could allow remote attackers to gain hard‑coded credentials.
A recent NVD entry lists CVE‑2026‑129444 as a critical flaw in the D‑Link DSL‑6740C router’s FTP daemon. The vulnerability allows manipulation of /etc/templates/ftpd/ftpd_conf.php, resulting in hard‑coded credentials that can be exploited remotely. The CVSS score is 10.0, and the record shows no vendor advisory, no fixed version, and no CISA KEV listing. No evidence of active exploitation was found during the 2026‑11‑14 – 2026‑11‑15 window. Defenders should monitor D‑Link’s website and NVD for a patch release, immediately replace default FTP credentials on any DSL‑6740C units, disable or restrict FTP access if not needed, and apply the patch as soon as it becomes available. View NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-129444
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.