The vulnerability resides in the mydlink_set_root_pwd function of the D-Link DCS-6501LH firmware version 3.03.02. A malicious actor can manipulate this function to assign a weak or known root password, effectively bypassing the device’s authentication mechanism. This flaw falls under CWE‑1391, Credential Validation, and permits an attacker to gain privileged access to the camera’s configuration interface and underlying system.

D-Link DCS-6501LH model firmware 3.03.02 is affected.

The CVSS score of 6.3 signifies a moderate risk, yet the EPSS score of less than 1% indicates that exploitation is unlikely at present. The CVE is not listed in the CISA KEV catalog. Although the attack can be launched remotely, the description notes a high level of complexity and difficult exploitation, which together reduce the overall threat level. The primary attack vector is likely remote over the device’s management interface, requiring the attacker to supply a crafted payload that triggers the vulnerable function.