CVE-2026-42372 identifies a vulnerability in the D-Link DIR-605L A1 firmware where a hardcoded telnet backdoor exists. The device starts a telnet daemon at boot with a fixed username and password stored in a configuration file. The authentication mechanism uses a simple string comparison, allowing an attacker on the local network to gain root access without prior authorization. Because the device is End-of-Life, no official fix or patch is available.

An unauthenticated attacker on the local network can exploit this vulnerability to gain root shell access on the affected device. This grants full administrative control, potentially allowing complete compromise of the device and any connected network resources. The high CVSS score (8.8) reflects the critical confidentiality, integrity, and availability impacts. No patches are available due to the device's End-of-Life status.

Since the device is End-of-Life and no patches or official fixes are available, mitigation involves removing the vulnerable device from the network or replacing it with a supported model. Network segmentation to isolate the device and disabling telnet access (if possible) may reduce risk but cannot fully mitigate the hardcoded credential issue. Monitoring for unauthorized telnet connections on the local network is recommended.