CVE-2026-42375: Hardcoded Telnet Backdoor Root Access in D-Link DIR-600L A1 Firmware

Vulnerability Summary: CVE-2026-42375 Vulnerability Overview Vulnerability ID: CVE-2026-42375 Vulnerability Name: Hardcoded Telnet Backdoor in D-Link DIR-600L A1 Firmware Severity: Critical Vulnerability Type: CWE-798 (Use of Hard-coded Credentials), CWE-912 (Hidden Malicious Code), CWE-259 (Password in Clear Text) Status: Fixed Release Date: April 21, 2026 Scope of Impact Affected Product: D-Link DIR-600L (Hardware Version A1, End-of-Life) Affected Vendor: D-Link Corporation / Alpha Networks Inc. (ODM) Vulnerability Principle: A hardcoded Telnet backdoor script ( ) exists within the firmware file system and executes unconditionally during device boot. Attackers can obtain root privileges by connecting to the router's Telnet service (TCP 23) and entering the hardcoded credentials. Exploitation Conditions: No authentication, session tokens, or CSRF tokens are required; the vulnerability can be exploited immediately after device boot. Impact Once an attacker gains a root shell, they can perform the following actions: Execute arbitrary commands as root Read/modify router configurations, including WiFi passwords and DNS settings Intercept, redirect, or modify all network traffic Install persistent malware or perform lateral movement within the internal network Remediation Official Patch: This product has reached End-of-Life (EOL), and the vendor will not release patches. Recommended Measures: 1. Immediately replace the device with a currently supported router model. 2. Temporary mitigation: Terminate the process via the backdoor and block port 23 (note: this will fail upon reboot). 3. Do not use this device on security-sensitive networks. Proof of Concept (POC) Startup Script ( ): Exploitation Steps: 1. Connect to the router (default LAN IP: 192.168.0.1) 2. Enter the username: at the "Login" prompt 3. Enter the password: at the "Password" prompt 4. Immediately obtain a root shell

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-42375: Hardcoded Telnet Backdoor Root Access in D-Link DIR-600L A1 Firmware