CVE-2026-10045 affects the DR300 router from Shenzhen Kangda Xin Intelligent Network Technology Co., Ltd, specifically version 2.1.2.121. The device includes hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. This combination allows unauthenticated remote attackers to gain unauthorized access to the device, enabling them to read and write memory, modify firmware, inspect active network connections, and view connected devices. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation allows attackers to fully compromise the affected router, including unauthorized memory access, firmware modification, and network reconnaissance. This can lead to persistent device compromise, interception or manipulation of network traffic, and potential disruption of network services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable telnet access on WAN and LAN interfaces if possible and restrict network access to the device. Consider isolating the device from untrusted networks to reduce exposure.