CVE-2026-10045
A Shenzhen Kangda Xin Intelligent Network Technology router (model DR300, firmware 2.1.2.121) contains hardcoded login credentials and has telnet enabled by default on both WAN and LAN interfaces. This flaw allows attackers to read and write memory, modify firmware, inspect active connections, and view connected devices. The vulnerability is rated critical with a CVSS score of 9.8.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Shenzhen Kangda Xin Intelligent Network Technology's DR300 router, firmware version 2.1.2.121.
Real-world impact
An attacker could gain full control of the router, modify its firmware, read or write memory, and see all devices connected to the network.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and it allows complete compromise of confidentiality, integrity, and availability.
What to do about it
- ›Disable telnet on both WAN and LAN interfaces.
- ›Change the default hardcoded credentials to a strong, unique password.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.