CVE-2026-10045: Kangda Xin DR300 Router Auth Bypass Flaw

CVE-2026-10045 Overview

CVE-2026-10045 affects the Shenzhen Kangda Xin Intelligent Network Technology Company DR300 router running firmware version 2.1.2.121. The device ships with hardcoded login credentials and exposes Telnet on both WAN and LAN interfaces by default. Attackers can authenticate remotely without prior access and gain full control of the router. Successful exploitation lets adversaries read and write device memory, modify firmware stored in flash, inspect active connections, and enumerate connected clients. The combination of network-reachable Telnet and embedded credentials makes the device trivially exploitable from the public internet.

Critical Impact
Unauthenticated remote attackers can take full control of DR300 routers, modify firmware, and pivot into connected networks.

Affected Products

Shenzhen Kangda Xin Intelligent Network Technology DR300 router
Firmware version 2.1.2.121
Devices with Telnet enabled by default on WAN and LAN interfaces

Discovery Timeline

2026-06-09 - CVE-2026-10045 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-10045

Vulnerability Analysis

The DR300 router contains two compounding weaknesses that result in complete device compromise. First, the firmware embeds static login credentials that cannot be changed or disabled by the end user. Second, the Telnet service is enabled by default and bound to both the LAN and the WAN interfaces, exposing the management channel directly to the internet.

An attacker scanning for open Telnet ports can authenticate using the hardcoded credentials and obtain an interactive shell on the device. From this shell, the attacker can read and write arbitrary memory regions, overwrite firmware images stored in flash, list active network connections, and enumerate devices on the LAN. This level of access supports persistent backdoors, traffic interception, and lateral movement into the home or business network behind the router.

Root Cause

The root cause is a combination of hardcoded credentials [CWE-798] and insecure default configuration [CWE-1188]. Credentials baked into the firmware image cannot be rotated, and the Telnet daemon is started by the device init scripts without restricting its listening interfaces. There is no authentication hardening, rate limiting, or interface binding policy applied to the management service.

Attack Vector

Exploitation requires no user interaction and no prior privileges. An attacker connects to TCP port 23 on the router's WAN address, supplies the hardcoded username and password, and receives a shell. Because the Telnet protocol transmits credentials in cleartext, passive observers on the network path can also harvest authentication material. The vulnerability mechanism is described in the Ruben Abreu Analysis on Temu Routers, which documents the embedded credentials and exposed services.

Detection Methods for CVE-2026-10045

Indicators of Compromise

Unexpected inbound TCP connections to port 23 on the router's WAN interface
Modified firmware checksums or unexplained reboots of the DR300 device
New or unknown processes listening on the router after a configuration session
Outbound connections from the router to unfamiliar command-and-control hosts

Detection Strategies

Scan internal and perimeter network ranges for devices with TCP 23 open and fingerprint responses matching the DR300
Inspect router logs, where available, for successful Telnet logins from external IP addresses
Compare current firmware hashes against vendor-supplied baselines to detect tampering

Monitoring Recommendations

Alert on any Telnet traffic crossing the network perimeter, both inbound and outbound
Monitor DHCP and ARP tables for unexpected new devices appearing behind the router
Capture NetFlow or equivalent telemetry to identify routers initiating unusual outbound sessions

How to Mitigate CVE-2026-10045

Immediate Actions Required

Remove DR300 routers running firmware 2.1.2.121 from any internet-facing role until a fix is verified
Block inbound TCP port 23 at the upstream gateway or ISP-managed device
Place affected routers behind a separately managed firewall that filters management protocols
Replace the device with hardware from a vendor that supports credential rotation and disabled-by-default Telnet

Patch Information

No vendor advisory or firmware patch has been published in the NVD record for CVE-2026-10045. Because the credentials are embedded in the firmware image, only a vendor-issued firmware update can fully remediate the issue. Users should monitor the manufacturer's website for updates and treat the device as untrusted in the interim.

Workarounds

Disable Telnet through the router's administrative interface if the option is exposed, and verify port 23 is closed afterwards
Segment the DR300 onto an isolated VLAN with no route to sensitive internal systems
Restrict WAN-side management access using upstream ACLs that permit only known administrative IP addresses
Decommission the device where the above controls cannot be enforced

bash

# Example upstream ACL to block Telnet exposure to the DR300
iptables -I FORWARD -p tcp --dport 23 -d <DR300_WAN_IP> -j DROP
iptables -I INPUT   -p tcp --dport 23 -j DROP