Hardcoded Telnet Backdoor in D-Link DIR-605L Device

CVE-2026-42372

What is CVE-2026-42372?

The D-Link DIR-605L Hardware Revision A1 has a hardcoded telnet backdoor that poses significant security risks. When booted, the device initializes a telnet daemon using a predefined username 'Alphanetworks' and a static password, enabling an unauthenticated attacker on the local network to gain root shell access. This vulnerability is exacerbated by the fact that the device has reached End-of-Life (EOL) status and will not receive any patches or updates, leaving it particularly vulnerable to exploitation.

References