What is the CVSS score of EUVD-2026-27025?

EUVD-2026-27025 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of D-Link DIR-600L are affected by EUVD-2026-27025?

D-Link DIR-600L B1 routers contain a hardcoded telnet backdoor allowing unauthenticated remote attackers to obtain root shell access using publicly known credentials, creating critical risk for any…

How to fix or mitigate EUVD-2026-27025?

Within 24 hours: Conduct network inventory scan to identify all D-Link DIR-600L hardware revision B1 devices using SNMP enumeration, SSH/Telnet banner grabbing, or DHCP/DNS lease analysis; isolate any identified units to a quarantined network segment. Within 7 days: Replace all identified DIR-600L B1 devices with current-generation routers from supported vendors; document decommissioned units and destruction/secure erasure procedures. Within 30 days: Complete replacement deployment, validate zero DIR-600L B1 devices remain on production networks, and implement network segmentation policies to prevent unauthorized router access via administrative interfaces.

D-Link DIR-600L EUVD-2026-27025

| CVE-2026-42374 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-04 securin

D-Link Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 17:00 vuln.today

EUVD ID Assigned

May 04, 2026 - 16:30 euvd

EUVD-2026-27025

Analysis Generated

May 04, 2026 - 16:30 vuln.today

CVE Published

May 04, 2026 - 16:00 nvd

CRITICAL 9.8

DescriptionCVE.org

D-Link DIR-600L Hardware Revision B1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn61_dlwbr_dir600L" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.

AnalysisAI

D-Link DIR-600L Hardware Revision B1 routers expose a hardcoded telnet backdoor granting unauthenticated remote attackers root shell access via static credentials ('Alphanetworks' / 'wrgn61_dlwbr_dir600L'). The vulnerability affects End-of-Life devices that will never receive patches, making permanent network isolation or replacement the only remediation options. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly documented credentials, this represents critical risk for any exposed device, though exploitation requires local network access despite the 'Network' attack vector classification.

Technical ContextAI

The DIR-600L firmware implements a persistent telnet service through /bin/telnetd.sh that launches at boot time with hardcoded credentials stored in cleartext within /etc/alpha_config/image_sign. The custom telnetd binary uses a non-standard '-u user:password' flag for authentication, while the associated login binary performs credential validation using strcmp() against the static values. This represents CWE-798 (Use of Hard-coded Credentials), a fundamental design flaw where authentication secrets are embedded in the product rather than user-configurable. The CPE identifier (cpe:2.3:a:d-link:dir-600l_firmware) indicates all firmware versions for Hardware Revision B1 are affected, as this backdoor appears to be an intentional design element rather than an accidental vulnerability-potentially for manufacturer remote support access.

RemediationAI

D-Link will not release patches for the EOL DIR-600L Hardware Revision B1-permanent remediation requires replacing affected devices with currently supported router models. For organizations unable to immediately replace hardware, implement network-level isolation: place affected routers behind a firewall that blocks inbound telnet (TCP/23) from all sources, restrict management access to a dedicated out-of-band management VLAN, and deploy network monitoring to detect telnet connection attempts to the device. Deploy compensating controls including disabling remote management features if configurable through the web interface, implementing 802.1X port-based network access control on the LAN side to limit who can reach the router's IP address, and segmenting the network so the router only routes between untrusted and trusted zones without hosting critical management functions. WARNING: These mitigations only reduce attack surface-the backdoor remains in firmware and could be exploited by any attacker who gains LAN access through other means (rogue access point, compromised endpoint, physical access). The telnet service likely cannot be disabled without custom firmware modification. Priority should be immediate budget allocation for hardware replacement rather than long-term reliance on compensating controls.