CVE-2026-10045: CVE-2026-10045

Synopsis

This is an authentication bypass and hardcoded-credentials vulnerability in the Shenzhen Kangda Xin DR300 router (firmware version 2.1.2.121). The device ships with telnet enabled by default on both its WAN and LAN interfaces and uses hardcoded login credentials, meaning any attacker who can reach the device over a network can log in without knowing or guessing a password. Successful exploitation gives the attacker full read/write access to device memory, the ability to modify flash-stored firmware, and visibility into all active and connected network clients. No fix version has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as the vendor ships a corrected firmware release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device over the network; telnet is exposed on both WAN and LAN interfaces by default, making this reachable from the public internet as well as internal networks.

• AuthenticationNot required

  No credential discovery is needed because the device ships with hardcoded credentials, effectively removing authentication as a barrier.

• Victim interactionNot required

  No user action is required; the attacker connects directly to the telnet service without involving any device user.

• Attack complexityDetail

  Attack complexity is low: the exploit is straightforward and reliable, requiring no race conditions, memory-layout knowledge, or other environmental preconditions.

Blast Radius

• Attacker reads and writes directly to device memory, gaining full visibility into runtime state and the ability to alter it.
• Attacker modifies firmware stored in flash, enabling persistent backdoors or malicious code that survive reboots.
• Attacker inspects all active network connections passing through or managed by the router.
• Attacker enumerates all currently connected devices on the network, supporting reconnaissance for follow-on attacks.