CVE-2015-7246

This flaw is basically “factory login still enabled.” The device ships with well-known default usernames and passwords for its administrator accounts (root/root and tw/tw). If those defaults weren’t changed, someone who can reach the device’s admin interface over the network can log in and take control—like getting the keys to the office desk that everyone uses.

This matters if you run or manage a D-Link DVG-N5402SP that is still on firmware W1000CN-00, W1000CN-03, or W2000EN-00 and the default credentials were never changed. The risk is specifically about an attacker being able to reach the router’s administrative interface over the network; in the default configuration, it’s not considered reachable, but it becomes a risk if remote/admin access is exposed or misconfigured. No user interaction is needed once the attacker has network access and the defaults remain unchanged.

Treat this as urgent because attackers can log in as an administrator using publicly known default credentials, which is a direct path to control of the device. The verdict for this item is AMBER: it’s not guaranteed to be reachable in a default setup, but if your admin interface is reachable and you still use defaults, it should be addressed now.

1. Identify affected devices

   • Log into the D-Link DVG-N5402SP management UI (using the current working admin account).
   • Confirm the firmware version is one of: W1000CN-00, W1000CN-03, or W2000EN-00.

2. Verify whether default credentials are still usable

   • Attempt to log in using the known defaults mentioned for this issue:
     • root / root
     • tw / tw
   • If either login works, you are directly exposed per the findings.

3. Immediate containment if still exposed

   • Change administrator passwords immediately to strong, unique credentials.
   • Disable or restrict remote administration and any “admin from WAN/network” settings if available, so the admin interface is not reachable from outside your trusted network.
   • Ensure no other accounts still use default or guessable passwords.

4. Upgrade to a non-affected firmware

   • Update to the latest D-Link DVG-N5402SP firmware version that is not W1000CN-00, W1000CN-03, or W2000EN-00.
   • After upgrading, repeat the credential-change verification (confirm default logins fail).

5. After remediation: watch for signs of compromise

   • Review device/system logs (admin login attempts, configuration changes).
   • Look for any admin logins occurring around the time the credentials may have been exposed.

6. Temporary workaround if you can’t patch immediately

   • Keep the admin interface inaccessible from any untrusted network, and ensure default credentials are changed.
   • If remote admin access is required, restrict it to specific IP addresses/VPN-connected clients only (where supported), rather than leaving it open.

Severity/impact: This is a default-credentials problem (CWE-798) where the D-Link DVG-N5402SP ships with known usernames/passwords for administrator accounts in firmware versions W1000CN-00, W1000CN-03, or W2000EN-00. Mechanism: an attacker can authenticate to the administrative interface over the network without any additional secret, using the publicly known default credentials; no user interaction is required.

Exploitation status: Public exploit exists (4 known). However, this specific issue is not listed in CISA KEV, and the findings also note “reachable in default config: false,” meaning reachability depends on how the admin interface is exposed/misconfigured in your environment.

EPSS: A prediction is available, but public blocks shouldn’t rely on it for urgency when direct authentication is possible; the operational risk mainly hinges on whether the device is on an affected firmware and whether default credentials remain unchanged.

How KEV relates here: KEV is not listed, so this is not confirmed as a KEV-tracked case in the provided findings.