CVE-2026-42373 identifies a critical vulnerability in the D-Link DIR-605L B2 firmware where a hardcoded telnet backdoor exists. The device runs a telnet daemon at startup using a fixed username and password stored in a configuration file. Authentication is performed via a custom login binary that compares credentials using strcmp(), enabling an attacker on the local network to gain root access without prior authorization. The device is no longer supported by the vendor and will not receive any official fixes.

An unauthenticated attacker on the local network can exploit this vulnerability to gain root shell access on the affected device, resulting in full administrative control. This compromises confidentiality, integrity, and availability of the device and potentially the network it is connected to. Since the device is End-of-Life, no official patches are available, increasing the risk of exploitation in environments where this hardware is still in use.

No official patch or fix is available because the device has reached End-of-Life status. Mitigation involves discontinuing use of the affected hardware or isolating it from untrusted local networks to prevent unauthorized access. Network administrators should consider replacing the device with a supported model that does not contain this vulnerability.