D-Link DIR-605L EUVD-2026-27023

Requires attacker presence on the same local network segment (LAN or Wi-Fi) as the D-Link DIR-605L B2 device - not exploitable from internet without prior internal network access or VPN connection to target network. Telnet daemon starts automatically at boot via /bin/telnetd.sh, requiring no manual service enablement or non-default configuration. Exploitation limited to Hardware Revision B2 specifically; other DIR-605L hardware revisions not confirmed affected. Attack succeeds against all firmware versions for this hardware revision due to hardcoded credentials in /etc/alpha_config/image_sign. No user interaction, no authentication beyond knowledge of static credentials, no specific feature enablement required. Limiting factors: network proximity requirement (AV:A equivalent despite CVSS AV:N rating), attacker must know or discover the specific hardcoded credentials, telnet port 23 must be reachable (not blocked by upstream firewall or network segmentation).

Critical risk assessment reveals significant attack surface complexity. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rates this as network-exploitable with no authentication, but the description specifies 'local network' access, indicating AV:N may overstate internet-wide risk - this appears to be AV:A (adjacent network) in practice. Real-world exploitation requires attacker presence on the same LAN segment or Wi-Fi network as the device. The hardcoded credentials are now publicly documented via Securin advisory, lowering AC to trivial for any attacker with network proximity. No CISA KEV listing suggests this has not been observed in widespread campaigns, though absence from KEV does not confirm zero exploitation - EOL consumer devices often escape federal monitoring. EPSS score unavailable limits probabilistic risk modeling. Critical mitigating factor: Hardware Revision B2 reached End-of-Life status, meaning affected devices represent legacy installations rather than actively sold products, naturally limiting exposure growth. However, installed base remains vulnerable indefinitely. SSVC assessment: Exploitation is automatable once LAN access achieved, technical impact is total system compromise, but exploitation status appears proof-of-concept disclosure rather than active campaigns. Priority depends entirely on whether these devices remain in production networks versus home/SOHO environments.

Attacker connects to enterprise guest Wi-Fi network where DIR-605L B2 provides internet access. Using network scanning, attacker identifies telnet service on TCP port 23. Attacker connects via telnet client and authenticates with username 'Alphanetworks' and password 'wrgn76_dlwbr_dir605L' obtained from public Securin advisory. System grants root shell, enabling attacker to modify firewall rules, capture all network traffic passing through router, pivot to connected devices, or establish persistent access via firmware modification.