CVE-2026-42373
Published: 04 May 2026
Summary
CVE-2026-42373 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Dlink Dir-605L Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Remote Services (T1021); ranked at the 37.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-42373 is a hardcoded credential vulnerability (CWE-798) in the D-Link DIR-605L Hardware Revision B2 router, an end-of-life (EOL) device. The flaw involves a telnet backdoor daemon launched at boot via the /bin/telnetd.sh script, which configures the service with a static username of "Alphanetworks" and password "wrgn76_dlwbr_dir605L" sourced from /etc/alpha_config/image_sign. A custom telnetd binary accepts a -u user:password flag, while the custom login binary performs credential validation using strcmp(). The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An unauthenticated attacker with access to the local network can exploit this by connecting to the telnet service using the hardcoded credentials, gaining a root shell with full administrative control over the device.
Advisories, including those published by Securin at https://www.securin.io/zero-day/cve-2026-42373-hardcoded-telnet-backdoor-in-d-link-dir-605l-b2-end-of-life-, confirm the device is EOL and will not receive patches from D-Link. Mitigation requires isolating affected devices from untrusted networks or decommissioning them entirely, as no firmware updates are available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27023
Vulnerability details
D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn76_dlwbr_dir605L" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a…
more
-u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hardcoded credentials enable direct authentication to the telnet remote service (T1021) using valid accounts (T1078) for initial root shell access on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Prohibits the use of unsupported end-of-life devices like the D-Link DIR-605L, preventing deployment or continued operation of systems with unpatchable hardcoded backdoors.
Requires identification, prioritization, and remediation of flaws such as this hardcoded telnet backdoor, necessitating replacement or isolation of the affected EOL router.
Enforces boundary protection to monitor and control communications at system boundaries, isolating the telnet service from untrusted local network access.