What is the CVSS score of CVE-2026-42375?

CVE-2026-42375 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of D-Link DIR-600L are affected by CVE-2026-42375?

D-Link DIR-600L routers contain a hardcoded backdoor account with publicly known credentials that grants unauthenticated remote root access to attackers on the network.

How to fix or mitigate CVE-2026-42375?

Within 24 hours: Inventory all D-Link DIR-600L Hardware Revision A1 devices across the network and document their location, connected systems, and criticality. Within 7 days: Isolate or physically disconnect any DIR-600L devices not essential to operations; if isolation is infeasible, segment them to a restricted VLAN with no access to sensitive systems or data. Within 30 days: Replace all DIR-600L units with current-generation routers from D-Link or alternative vendors that receive active security support; establish a hardware refresh policy to retire end-of-life network equipment within 3 years of end-of-support.

D-Link DIR-600L CVE-2026-42375

EUVD-2026-27027 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-04 securin

D-Link Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 17:01 vuln.today

EUVD ID Assigned

May 04, 2026 - 16:30 euvd

EUVD-2026-27027

Analysis Generated

May 04, 2026 - 16:30 vuln.today

CVE Published

May 04, 2026 - 16:02 nvd

CRITICAL 9.8

DescriptionCVE.org

D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn35_dlwbr_dir600l" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.

AnalysisAI

Remote root shell access via hardcoded telnet backdoor in D-Link DIR-600L Hardware Revision A1 allows network-adjacent attackers to authenticate with publicly known credentials ('Alphanetworks' / 'wrgn35_dlwbr_dir600l') and obtain full administrative control. The backdoor telnet daemon launches automatically at boot with static credentials stored in /etc/alpha_config/image_sign. The device is End-of-Life with no patches forthcoming, creating permanent exposure for deployed units. EPSS data not available; no CISA KEV listing identified, though the trivial exploitation complexity (CVSS AC:L, PR:N) and public disclosure make exploitation highly likely once details are disseminated.

Technical ContextAI

This is a CWE-798 (Use of Hard-coded Credentials) vulnerability affecting the D-Link DIR-600L Hardware Revision A1 firmware. The device executes /bin/telnetd.sh at boot, launching a custom telnetd binary configured with the -u flag to specify username:password combinations. Authentication credentials are hardcoded in the /etc/alpha_config/image_sign configuration file and validated via insecure strcmp() comparison in a custom login binary. The 'Alphanetworks' username suggests this may be a manufacturer debugging interface left active in production firmware. The telnet protocol itself transmits credentials in cleartext, compounding the security failure. The CPE identifier cpe:2.3:a:d-link:dir-600l_firmware confirms this affects the device firmware rather than just configuration, meaning the backdoor exists in the base image distributed by D-Link. As an EOL product, the firmware will remain vulnerable indefinitely.

RemediationAI

Immediate device replacement is the only effective remediation, as D-Link will not release patches for this EOL hardware revision. Organizations should identify all DIR-600L Hardware Revision A1 units via asset inventory, remove them from production networks, and replace with currently supported router models. As a temporary risk reduction measure until replacement, implement network-layer controls: configure upstream firewalls or VLANs to block all inbound TCP port 23 (telnet) traffic to affected devices, disable telnet access in router web interface if the option exists (though the daemon launches via init scripts and may bypass UI controls), and isolate devices on separate network segments with strict ACLs preventing lateral movement. Monitor network traffic for telnet connections to DIR-600L units as an indicator of compromise. Note that blocking telnet does not eliminate the backdoor code-it only prevents remote exploitation while the credentials remain embedded in firmware. These compensating controls reduce attack surface but cannot provide equivalent security to patched firmware. Asset replacement timeline should be measured in days, not weeks, given the trivial exploitation and complete system compromise outcome.