Improper Authentication in DTS Redline WR3200
CVE-2026-6274 affects DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 versions 7.1.3 through before 7.1.8. The available description indicates multiple authentication weaknesses, specifically improper authentication, missing authentication for a critical function, and weak authentication, which together allow access to functionality that is not properly constrained by ACLs. Based on the provided information, the flaw is reachable over the network and does not require prior authentication or user interaction. Specific vulnerable endpoints, functions, or code paths are not identified in the provided content.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Small standalone exploit repository containing one Python PoC script and two README files (English and Turkish). The exploit targets CVE-2026-6274 in Redline WR3200 routers before firmware v7.1.8. The core issue described by the repository is an authentication bypass caused by reliance on static cookies (user=admin and platform=1) combined with insufficient authorization checks on the password-management endpoint. The Python script exploit.py is the only code file and main entry point. It accepts a target IP and a new password, builds an HTTP POST request to /goform/set_manpwd, sets the static cookies, and includes browser-like headers such as X-Requested-With, Content-Type, Referer, and User-Agent. If the target responds with HTTP 200, the script reports success and prints the server response. The exploit does not provide shell access or code execution; its capability is limited but impactful: unauthorized administrative password reset on the router. This is a real exploit PoC rather than a detector, with a hardcoded attack flow and no framework integration.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.