What this actually is.
Technical background, root cause, and affected surface.
D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn35_dlwbr_dir600l" read from /etc/alpha_config/image_sign. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
- Vendor
- D-Link Corporation / Alpha Networks Inc. (ODM)
- Affected Product
- D-Link DIR-600L Hardware Revision A1 (End-of-Life)
- CVE
- CVE-2026-42375
- CWE
- CWE-798, CWE-912, CWE-259
- Status
- No Vendor Fix Available
- Date
- April 21, 2026
- Severity
- High
- CVSS Score
- 8.8
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
An attacker on the same LAN or WiFi network as the DIR-600L A1 (EOL) can gain full root shell access by connecting to the telnet service (TCP port 23) and entering the hardcoded Alphanetworks credentials. No prior authentication, session tokens, or CSRF tokens are required. The backdoor is available immediately after device boot.Exploitation StepsStep 1: Connect to telnet on the router (default LAN IP)
The bug, and the fix.
Root cause: Backdoor originates from Alpha Networks Inc. (Taiwanese ODM). The "Alphanetworks" username, /etc/alpha_config/ directory, and wrg-prefixed passwords directly identify the ODM. Intended for factory testing but never removed from production firmware.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Exploitation grants root shell on the DIR-600L A1 (End-of-Life). An attacker on the LAN/WiFi can:
Execute arbitrary commands as root
Read/modify all router configuration including WiFi passwords and DNS settings
Intercept, redirect, or modify all network traffic
Install persistent malware or pivot into the internal network
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Replace the device immediately with a currently supported router model.
Temporary: kill telnetd via backdoor and block port 23 (lost on reboot)
Do not use this device for any security-sensitive network
This product is End-of-Life (EOL). No patches will be released by D-Link.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Backdoor identified via firmware static analysis
Validated via QEMU
Reported to Vendor
Vendor confirmed EoL status; no fix will be issued
Follow up with Vendor
Advisory release confirmed
CVE assigned: CVE-2026-42375
Disclosed 4 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.