CVE-2026-42372 Details
Description
D-Link DIR-605L Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn35_dlwbr_dir605l" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
A hardcoded telnet backdoor has been identified in the D-Link DIR-605L router, Hardware Revision A1, which has reached its End-of-Life (EOL) status. The device activates a telnet daemon at boot, using the username 'Alphanetworks' and a static password 'wrgn35_dlwbr_dir605l', both of which are hardcoded and stored in plaintext within the firmware. This backdoor allows an unauthenticated attacker on the same local network to gain root access and full administrative control over the device.
Users are advised to replace the device with a currently supported router model. As a temporary measure, the telnet service can be terminated and port 23 blocked, although this will be reset after a reboot.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.securin.io/zero-day/cve-2026-42372-hardcoded-telnet-backdoor-in-d-link-dir-605l-a1-end-of-life- | CISA-ADP | ExploitThird Party Advisory |
| https://www.securin.io/zero-day/cve-2026-42372-hardcoded-telnet-backdoor-in-d-link-dir-605l-a1-end-of-life- | securin | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | securin |
Affected Products
| Product | Versions |
|---|---|
| dlink dir-605l firmware | All versions |
CPE
Remediation
| |
| dlink dir-605l | a1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | securin |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | securin |
| May 4, 2026 | CVE Modified | CISA-ADP |