What is the CVSS score of CVE-2026-42372?

CVE-2026-42372 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of D-Link DIR-605L are affected by CVE-2026-42372?

D-Link DIR-605L routers contain hardcoded credentials enabling unauthenticated root-level access via telnet from adjacent networks, allowing attackers to intercept traffic, modify configurations, and…

How to fix or mitigate CVE-2026-42372?

Within 24 hours: Conduct network scan to identify all D-Link DIR-605L Hardware Revision A1 devices in production and document their current business function. Within 7 days: Isolate affected devices from production networks or place behind monitored network segments; disable telnet access at the network perimeter if device removal is not immediately feasible. Within 30 days: Complete replacement of all DIR-605L units with current-generation equipment from D-Link or alternative vendor with active security support and non-default credentials.

D-Link DIR-605L CVE-2026-42372

EUVD-2026-27021 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-05-04 securin

Authentication Bypass D-Link Dir 605l Firmware D-Link

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 17:00 vuln.today

EUVD ID Assigned

May 04, 2026 - 16:30 euvd

EUVD-2026-27021

Analysis Generated

May 04, 2026 - 16:30 vuln.today

CVE Published

May 04, 2026 - 15:53 nvd

HIGH 8.8

DescriptionCVE.org

D-Link DIR-605L Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn35_dlwbr_dir605l" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.

AnalysisAI

Hardcoded credentials in D-Link DIR-605L Hardware Revision A1 firmware grant root-level telnet access to unauthenticated attackers on adjacent networks. The telnet daemon automatically starts at boot with username 'Alphanetworks' and static password 'wrgn35_dlwbr_dir605l', enabling complete device takeover including network traffic interception, configuration modification, and pivot attacks against internal networks. This End-of-Life product will receive no vendor patch, requiring immediate device replacement. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, with adjacent network attack vector reducing but not eliminating risk for home and small office deployments.

Technical ContextAI

The vulnerability stems from CWE-798 (Use of Hard-coded Credentials) implemented in D-Link's custom telnet daemon binary and login system. The /bin/telnetd.sh initialization script launches at boot, invoking a modified telnetd binary with the -u flag to set credentials. The password 'wrgn35_dlwbr_dir605l' is statically stored in /etc/alpha_config/image_sign and validated using unsafe strcmp() comparison in the custom login binary. The 'Alphanetworks' username suggests these are vendor/OEM backdoor credentials, possibly for manufacturing or support access. The affected CPE cpe:2.3:a:d-link:dir-605l_firmware covers all firmware versions for Hardware Revision A1, as the credentials are embedded in the base system initialization rather than configuration files. This represents a fundamental architectural security flaw rather than a software bug, making it unpatchable without firmware replacement.

RemediationAI

Immediate device replacement is the ONLY remediation - no patch exists or will be released for this EOL hardware. Organizations must procure current-generation routers with active vendor support and migrate networks within 30-60 days maximum. Interim risk reduction (if immediate replacement is impossible): Disable the wireless radio entirely to eliminate Wi-Fi-based adjacent network access, forcing attackers to require physical LAN connection (trades convenience for attack surface reduction). Isolate the DIR-605L behind a secure upstream firewall/router that performs actual perimeter security, treating the D-Link device as an untrusted switch-only device (negates its routing/firewall functions). Implement 802.1X port-based network access control on wired ports if technically feasible (requires infrastructure investment likely exceeding replacement cost). Deploy network intrusion detection to monitor for telnet connection attempts on port 23 to the device's management IP (detection-only, not prevention). All workarounds are temporary Band-Aids - the hardcoded credentials remain exploitable by any sophisticated attacker with network access. Budget and procurement processes must prioritize hardware replacement over mitigation attempts.