D-Link DIR-600L EUVD-2026-27025

Attacker must have IP-level network connectivity to the DIR-600L router's management interface on the LAN or WAN side where telnet service (TCP/23) is accessible. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no special conditions for exploitation once network access is achieved-default configuration with telnet daemon running at boot is sufficient. Critically limiting factors: 'Network' attack vector primarily means local network positioning (same subnet or routing path to the device) rather than internet-wide exploitation, as most deployments place router management interfaces on private RFC1918 addressing. However, if the device WAN interface has telnet exposed or port forwarding misconfigured, internet-based exploitation becomes possible. No user interaction, authentication, or non-default configuration required-the backdoor is active on every DIR-600L Hardware Revision B1 device from factory default state.

The CVSS 9.8 score accurately reflects the technical severity: network-accessible, no authentication required, low complexity, and full system compromise (C:H/I:H/A:H). However, real-world risk requires nuanced assessment. The 'AV:N' (Network) vector is technically accurate as telnet is a network protocol, but exploitation realistically requires local network positioning-an attacker must be on the same LAN segment or have already compromised the network perimeter. No EPSS score is provided in the data, and no CISA KEV listing exists, suggesting this is not yet widely exploited despite public credential disclosure. The authentication bypass combined with root shell access makes this trivially automatable once network access is achieved. The critical factor elevating real-world risk is the EOL status: no patches will ever be released, meaning vulnerable devices remain permanently exploitable. Organizations still operating these devices face a binary choice between network isolation/replacement or accepting persistent compromise risk. The publicly documented credentials in the Securin disclosure make this a known-exploitable condition for any attacker with network access to the device.

An attacker on the local network (via compromised workstation, rogue wireless connection, or guest network access) performs network scanning to identify the DIR-600L router's IP address, then initiates a telnet connection to TCP port 23. The attacker enters the publicly known username 'Alphanetworks' and password 'wrgn61_dlwbr_dir600L', which the custom telnetd validates via strcmp() against the hardcoded values in /etc/alpha_config/image_sign. Upon successful authentication, the attacker receives a root shell with full administrative control, enabling configuration changes, traffic interception, DNS hijacking, firmware replacement, or use of the compromised router as a pivot point for deeper network penetration.