D-Link DIR-456U CVE-2026-42376

Network reachability to D-Link DIR-456U telnet daemon on TCP port 23 is the sole exploitation prerequisite. Default firmware configuration launches telnetd at boot via /etc/init0.d/S80telnetd.sh with hardcoded credentials enabled-no non-default configuration or feature enablement required. Device Hardware Revision A1 specifically affected per CVE scope. Exploitation is unauthenticated (CVSS PR:N) as attacker uses hardcoded vendor credentials rather than requiring legitimate user accounts. No user interaction needed (CVSS UI:N). Limiting factors: Attacker must achieve network-layer connectivity to telnet service, which typically requires local network positioning (LAN/WLAN access) unless device is internet-exposed via port forwarding or DMZ placement. Telnet traffic unencrypted and often blocked by ISP/enterprise perimeter controls, reducing internet-based attack likelihood but not eliminating internal threat scenarios or WiFi-proximate attackers.

CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) accurately reflects the technical severity of unauthenticated network-accessible remote root access. However, real-world risk assessment reveals critical nuances: AV:N suggests internet exposure but telnet typically requires local network positioning (RFC 854 default port 23 commonly filtered at perimeter). Attack complexity is genuinely low (AC:L) with publicly disclosed credentials eliminating any technical barrier. End-of-Life status is the decisive risk factor-no patch will ever be released per vendor lifecycle policy, making this a permanent exposure for deployed units. SSVC decision tree indicates immediate action required: exploitation is straightforward (automatable with disclosed credentials), technical impact is total system compromise (root shell), but actual exploitation probability depends on attacker's network positioning. No EPSS score available limits probabilistic risk modeling. CISA KEV status not present suggests no confirmed widespread exploitation at time of discovery, though EOL status means monitoring will not continue. Priority depends entirely on deployment context: if devices are internet-facing or on networks accessible to untrusted users, replacement is mandatory; if isolated to management VLANs with strict access controls, risk may be temporarily acceptable pending hardware refresh cycles.

Attacker on local network (corporate WiFi, compromised adjacent system, or physical proximity to wireless router) runs network scan identifying DIR-456U device on TCP port 23. Using publicly disclosed credentials, attacker connects via telnet client and authenticates with username 'Alphanetworks' and password 'whdrv01_dlob_dir456U'. Authentication succeeds via strcmp() comparison, immediately granting interactive root shell with full administrative privileges. Attacker can now reconfigure routing tables, extract WiFi credentials, establish persistent backdoors, pivot to connected internal systems, or disable security logging-all actions masked under legitimate administrative context. No exploit code complexity required beyond standard telnet client, making attack trivially automatable and executable by low-skill adversaries.