CVE-2026-42373
Published: 04 May 2026
Description
D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn76_dlwbr_dir605L" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a…
more
-u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
Mitigating Controls (NIST 800-53 r5)AI
Prohibits the use of unsupported end-of-life devices like the D-Link DIR-605L, preventing deployment or continued operation of systems with unpatchable hardcoded backdoors.
Requires identification, prioritization, and remediation of flaws such as this hardcoded telnet backdoor, necessitating replacement or isolation of the affected EOL router.
Enforces boundary protection to monitor and control communications at system boundaries, isolating the telnet service from untrusted local network access.
Security SummaryAI
CVE-2026-42373 is a hardcoded credential vulnerability (CWE-798) in the D-Link DIR-605L Hardware Revision B2 router, an end-of-life (EOL) device. The flaw involves a telnet backdoor daemon launched at boot via the /bin/telnetd.sh script, which configures the service with a static username of "Alphanetworks" and password "wrgn76_dlwbr_dir605L" sourced from /etc/alpha_config/image_sign. A custom telnetd binary accepts a -u user:password flag, while the custom login binary performs credential validation using strcmp(). The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An unauthenticated attacker with access to the local network can exploit this by connecting to the telnet service using the hardcoded credentials, gaining a root shell with full administrative control over the device.
Advisories, including those published by Securin at https://www.securin.io/zero-day/cve-2026-42373-hardcoded-telnet-backdoor-in-d-link-dir-605l-b2-end-of-life-, confirm the device is EOL and will not receive patches from D-Link. Mitigation requires isolating affected devices from untrusted networks or decommissioning them entirely, as no firmware updates are available.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Other AI Platforms
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- MITRE ATLAS Techniques
- None mapped
- Classification Reason
- Matched keywords: backdoor
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hardcoded credentials enable direct authentication to the telnet remote service (T1021) using valid accounts (T1078) for initial root shell access on the device.