What is the CVSS score of CVE-2026-42376?

CVE-2026-42376 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of D-Link DIR-456U are affected by CVE-2026-42376?

D-Link DIR-456U routers contain a hardcoded telnet backdoor that provides unauthenticated remote root access via static credentials, affecting any organization using this end-of-life device on their…

How to fix or mitigate CVE-2026-42376?

Within 24 hours: Identify all DIR-456U Hardware Revision A1 devices on the network using asset inventory or network scan; flag for urgent remediation. Within 7 days: Either air-gap affected devices (disconnect from production network) or begin replacement with current-generation routers from D-Link or alternative vendors. Within 30 days: Complete removal of all DIR-456U units; document disposition and update network architecture documentation.

D-Link DIR-456U CVE-2026-42376

EUVD-2026-27029 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-04 securin

D-Link Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 17:02 vuln.today

EUVD ID Assigned

May 04, 2026 - 16:30 euvd

EUVD-2026-27029

Analysis Generated

May 04, 2026 - 16:30 vuln.today

CVE Published

May 04, 2026 - 16:03 nvd

CRITICAL 9.8

DescriptionCVE.org

D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /etc/init0.d/S80telnetd.sh with the username "Alphanetworks" and the static password "whdrv01_dlob_dir456U" read from /etc/config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.

AnalysisAI

Hardcoded telnet backdoor in D-Link DIR-456U Hardware Revision A1 firmware grants remote unauthenticated attackers root shell access using static credentials ('Alphanetworks' / 'whdrv01_dlob_dir456U'). The telnet daemon launches automatically at boot via /etc/init0.d/S80telnetd.sh and validates credentials through strcmp() comparison against hardcoded values in /etc/config/image_sign. Device is End-of-Life with no patches forthcoming. CVSS 9.8 reflects network-accessible unauthenticated remote code execution, though exploitation requires local network access to telnet service.

Technical ContextAI

This vulnerability stems from CWE-798 (Use of Hard-coded Credentials) implementation in custom telnetd and login binaries shipped with D-Link DIR-456U firmware. The /etc/init0.d/S80telnetd.sh startup script launches telnet daemon with hardcoded credentials passed via -u flag, reading password 'whdrv01_dlob_dir456U' from static configuration file /etc/config/image_sign. Authentication uses unsafe strcmp() string comparison in custom login binary rather than cryptographic validation. The CPE identifier cpe:2.3:a:d-link:dir-456u_firmware:*:*:*:*:*:*:*:* indicates all firmware versions for Hardware Revision A1 contain these embedded credentials, representing a design-level flaw rather than implementation bug. This constitutes a deliberate backdoor mechanism, likely intended for vendor maintenance access but left enabled in production firmware.

RemediationAI

No vendor-released patch exists or will be developed due to End-of-Life status-hardware replacement is the only permanent remediation. Immediate compensating controls: Disable telnet daemon by removing execute permissions on /etc/init0.d/S80telnetd.sh or deleting the startup script entirely (requires initial administrative access; prevents reactivation on reboot but may break vendor support workflows). Implement strict network segmentation placing DIR-456U devices on isolated management VLAN with ACLs permitting only necessary management traffic from trusted administrator workstations (reduces attack surface but does not eliminate vulnerability if attacker gains VLAN access). Block inbound TCP port 23 at perimeter firewall and on local network switches using port security features (prevents remote exploitation but ineffective against internal threat actors or lateral movement scenarios). Deploy network intrusion detection signatures monitoring for authentication attempts using username 'Alphanetworks' to detect exploitation attempts (detection only, not prevention). Trade-offs: All mitigations except replacement leave the underlying vulnerability exploitable under certain network conditions. Plan immediate hardware refresh to supported D-Link models or alternative vendors with active security support lifecycles.