D-Link DIR-600L EUVD-2026-27027

Attacker requires network connectivity to TCP port 23 on the DIR-600L device-typically local network (LAN/WLAN) adjacency for standard residential router deployments where WAN-side telnet is disabled by default. If the device is misconfigured with telnet exposed to the WAN interface, or deployed in a DMZ/bridged configuration, exploitation becomes possible from the Internet. No user interaction, authentication, or non-default configuration is required-the telnet daemon launches automatically at boot with backdoor credentials active. The limiting factor is network reachability rather than authentication barriers, privilege requirements, or configuration complexity. Hardware Revision A1 specifically is required; other revisions (B1, B2) have different firmware implementations and are not confirmed vulnerable to this specific backdoor.

This represents critical real-world risk despite absence of CISA KEV listing. The CVSS 9.8 score accurately reflects severity: network-accessible (AV:N), no complexity barriers (AC:L), no authentication required (PR:N), and complete system compromise possible (C:H/I:H/A:H). The combination of publicly disclosed static credentials, automatic service enablement at boot, and EOL status with guaranteed zero patches creates permanent exposure. SSVC framework indicates high priority: exploitation is trivially automatable (credentials are static and public), technical impact is total system compromise (root shell), and the device is Internet-facing network infrastructure. While EPSS score is unavailable due to recent disclosure, the attack can be scripted in minutes once an attacker identifies vulnerable devices via banner grabbing or port scanning. The primary limiting factor is that AV:N in this context likely means local network adjacency rather than Internet-wide exposure, as residential routers typically don't expose telnet to WAN interfaces by default-however, misconfigured devices or those in DMZs face direct Internet exposure. Organizations must assume any deployed DIR-600L A1 units are permanently compromised infrastructure.

An attacker on the same local network as the DIR-600L scans for open telnet services on TCP port 23, identifies the D-Link device via banner or response fingerprinting, then connects and authenticates using the publicly disclosed credentials 'Alphanetworks' with password 'wrgn35_dlwbr_dir600l'. Upon successful authentication, the attacker receives a root shell with full administrative privileges, enabling firmware manipulation, traffic interception/modification, DNS hijacking for connected clients, persistent backdoor installation, or pivoting to attack other network-connected devices. No exploit code complexity is required-standard telnet clients suffice, making this exploitable via basic scripting.