D-Link DIR-605L EUVD-2026-27021

Attacker must achieve adjacent network access - either (1) association with the wireless network if Wi-Fi is enabled (requires knowledge of or brute-force of Wi-Fi password unless network is open), or (2) physical connection to LAN ethernet ports, or (3) compromise of another device already on the same network segment. No authentication to the router itself is required (PR:N). No user interaction needed (UI:N). The telnet service runs automatically at boot on all DIR-605L Hardware Revision A1 units regardless of configuration settings - there is no 'disable telnet' option that would prevent exploitation. The vulnerability affects only the specific Hardware Revision A1 of DIR-605L; other hardware revisions (if they exist) are not confirmed vulnerable and may use different firmware architectures.

Real-world risk is MODERATE-HIGH for affected deployments despite 8.8 CVSS score. The Adjacent Network (AV:A) attack vector requires the attacker to be on the same local network segment - achievable through Wi-Fi association (if wireless is enabled), physical LAN access, or compromise of another network device. Attack Complexity Low (AC:L) and No Privileges Required (PR:N) mean any device on the network segment can exploit this immediately. The hardcoded nature makes this 100% reliable once network access is achieved. Primary risk scenarios: (1) Guest Wi-Fi networks where untrusted users gain adjacent access, (2) Multi-tenant environments like apartments or coworking spaces with shared network infrastructure, (3) Post-compromise lateral movement where attackers use compromised IoT devices to pivot to routers. CRITICAL LIMITATION: No EPSS score provided, no KEV status data, and no POC availability information prevent full risk quantification. However, the simplicity (telnet with known credentials) means exploitation requires only basic networking tools, making this effectively 'exploitable by script kiddies' once credentials are public. The EOL status eliminates any remediation path except device replacement, converting this from a patchable vulnerability into a permanent architectural flaw. Organizations still running DIR-605L A1 hardware face persistent compromise risk until physical replacement.

An attacker associates with the building's guest Wi-Fi network served by the vulnerable DIR-605L router. Using a laptop with standard telnet client, they connect to the router's LAN IP address (typically 192.168.0.1) on port 23, provide username 'Alphanetworks' and password 'wrgn35_dlwbr_dir605l', and receive an unauthenticated root shell. From this shell, they exfiltrate the WPA2 pre-shared key from configuration files, reconfigure firewall rules to enable port forwarding to internal hosts, install persistent backdoors in startup scripts, or use the router as a pivot point for attacks against other network devices. The attack requires zero technical sophistication beyond basic networking knowledge.