CVE-2026-42376: Hardcoded Telnet Backdoor in D-Link DIR-456U A1 (End-of-Life)

Description

D-Link DIR-456U Hardware Revision A1 is an End-of-Life (EOL) consumer router that contains a manufacturer-installed telnet backdoor with hardcoded credentials. This product reached End-of-Life (EOL) on End-of-Life (exact date not published by D-Link). D-Link has confirmed it will not release security patches for EOL products.

The telnet daemon starts unconditionally at boot with the username "Alphanetworks" and the static password. This password is stored in plaintext at /etc/config/image_sign in the firmware filesystem and is identical across all DIR-456U A1 devices. Successful authentication grants a root shell with full administrative control.

Vulnerable Code

Boot Script: /etc/init0.d/S80telnetd.sh

This script executes unconditionally at boot. There is no user-facing option to disable the telnet backdoor.

typescript

#!/bin/sh
echo [$0]: $1 ... > /dev/console
if [ "$1" = "start" ]; then
    if [ -f "/usr/sbin/login" ]; then
        image_sign=`cat /etc/config/image_sign`
        telnetd -l /usr/sbin/login -u Alphanetworks:$image_sign -i br0 &
    else
        telnetd &
    fi
else
    killall telnetd
fi

QEMU Validation

Tested with qemu-mips-static v7.2.0. Credentials delivered via named pipe (FIFO).

Proof of Concept

An attacker on the same LAN or WiFi network as the DIR-456U A1 (EOL) can gain full root shell access by connecting to the telnet service (TCP port 23) and entering the hardcoded Alphanetworks credentials. No prior authentication, session tokens, or CSRF tokens are required. The backdoor is available immediately after device boot.

Exploitation Steps

Step 1: Connect to telnet on the router (default LAN IP)

telnet 192.168.0.1

Step 2: At the "login:" prompt, enter the hardcoded username:

Alphanetworks

Step 3: At the "Password:" prompt, enter the firmware-specific password: sample

Step 4: Root shell is granted immediately:

uid=0(root) gid=0(root)

The attacker now has full control of the router.

Impact

Exploitation grants root shell on the DIR-456U A1 (End-of-Life). An attacker on the LAN/WiFi can:

Execute arbitrary commands as root
Read/modify all router configuration including WiFi passwords and DNS settings
Intercept, redirect, or modify all network traffic
Install persistent malware or pivot into the internal network

Root Cause

Backdoor originates from Alpha Networks Inc. (Taiwanese ODM). The "Alphanetworks" username, /etc/alpha_config/ directory, and wrg-prefixed passwords directly identify the ODM. Intended for factory testing but never removed from production firmware.

Remediation

This product is End-of-Life (EOL). No patches will be released by D-Link.

Replace the device immediately with a currently supported router model.
Temporary: kill telnetd via backdoor and block port 23 (lost on reboot)
Do not use this device for any security-sensitive network

Disclosure Timeline

Securin Zero-Days

Let Securin level up your security posture!

Company