CVE-2026-42372 describes a vulnerability in the D-Link DIR-605L A1 firmware where a hardcoded telnet backdoor exists. The device launches a telnet daemon at startup using a custom telnetd binary that accepts a user:password flag. Credentials are validated via a simple strcmp() function against hardcoded values stored in a configuration file. This allows any unauthenticated attacker on the local network to gain root-level access to the device. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). The device is End-of-Life, and no official patches or fixes are available.

An attacker with local network access can exploit the hardcoded credentials to gain root shell access on the affected device. This grants full administrative control, potentially allowing the attacker to modify device settings, intercept or redirect network traffic, or use the device as a foothold for further attacks. The vulnerability has a high CVSS score of 8.8, indicating a severe impact on confidentiality, integrity, and availability.

Since the device is End-of-Life and no patches or official fixes are available, remediation options are limited. It is recommended to replace the affected hardware with a supported device that receives security updates. Network segmentation to restrict local network access to the device and disabling telnet access if possible may reduce exposure. Monitor network traffic for unauthorized telnet connections. Patch status is not applicable as no fix will be provided.