What is the CVSS score of CVE-2026-42373?

CVE-2026-42373 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of D-Link DIR-605L are affected by CVE-2026-42373?

D-Link DIR-605L hardware revision B2 routers contain a hardcoded telnet backdoor with static credentials that permits unauthenticated remote root access from local network segments.

How to fix or mitigate CVE-2026-42373?

Within 24 hours: Inventory all D-Link DIR-605L Hardware Revision B2 devices across network and isolated infrastructure; verify firmware version via device web interface. Within 7 days: Isolate confirmed affected devices to segregated network segments with restricted access controls, or power down if operationally feasible. Within 30 days: Replace DIR-605L B2 units with supported alternatives and decommission hardware; if replacement is not immediately possible, enforce network-layer access restrictions (ACLs, VLAN isolation) blocking telnet (port 23) ingress to these devices.

D-Link DIR-605L CVE-2026-42373

EUVD-2026-27023 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-04 securin

D-Link Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 17:00 vuln.today

EUVD ID Assigned

May 04, 2026 - 16:30 euvd

EUVD-2026-27023

Analysis Generated

May 04, 2026 - 16:30 vuln.today

CVE Published

May 04, 2026 - 15:57 nvd

CRITICAL 9.8

DescriptionCVE.org

D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn76_dlwbr_dir605L" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.

AnalysisAI

Hardcoded telnet backdoor in D-Link DIR-605L Hardware Revision B2 firmware enables unauthenticated root access for remote attackers on the local network using static credentials 'Alphanetworks:wrgn76_dlwbr_dir605L'. The telnet daemon starts automatically at boot, validating credentials via strcmp() against hardcoded values in /etc/alpha_config/image_sign, granting complete administrative control to anyone who knows the password. This End-of-Life device will receive no security patches. EPSS data not available; no CISA KEV listing identified at time of analysis, suggesting targeted disclosure rather than widespread exploitation campaigns.

Technical ContextAI

The vulnerability stems from CWE-798 (Use of Hard-coded Credentials) implemented in the device's custom telnet authentication stack. At boot, /bin/telnetd.sh launches a modified telnetd binary that accepts a -u flag to set static credentials. The custom login binary uses strcmp() for credential validation against hardcoded values stored in /etc/alpha_config/image_sign. This backdoor appears intentional rather than accidental, using 'Alphanetworks' as the username - matching the ODM manufacturer behind various D-Link products. The CPE identifier cpe:2.3:a:d-link:dir-605l_firmware:*:*:*:*:*:*:*:* indicates all firmware versions for Hardware Revision B2 are affected, with the wildcard version field suggesting no version-specific mitigation exists within this hardware line.

RemediationAI

No vendor patch will be released - D-Link has designated Hardware Revision B2 as End-of-Life. Immediate action required: Replace affected DIR-605L B2 devices with currently supported router models from any vendor. Interim risk reduction (until replacement): Disable telnet service if firmware interface permits (unlikely given backdoor implementation), isolate device on separate VLAN with strict firewall rules blocking TCP port 23 inbound from all network segments, implement network access control (NAC) to restrict which devices can reach router management plane, deploy intrusion detection signatures for telnet authentication attempts using username 'Alphanetworks'. Trade-offs: disabling telnet may not be possible through standard interface if backdoor bypasses normal service controls; VLAN isolation reduces attack surface but adds network segmentation complexity; blocking port 23 at upstream firewall protects from lateral movement but requires attacker already breached internal network. All mitigations are temporary - hardware replacement is the only permanent remediation for devices with burned-in authentication backdoors.