CVE-2026-42374 is a critical vulnerability in the D-Link DIR-600L B1 firmware involving hardcoded credentials for a telnet backdoor. The device launches a telnet daemon at startup with a fixed username and password, allowing unauthenticated local attackers to gain root access. The authentication mechanism uses a custom login binary that validates credentials with strcmp(), which does not mitigate the risk of credential exposure. Since the device is End-of-Life, no official patches or fixes are available.

An attacker on the local network can gain full administrative control of the affected device by authenticating to the hardcoded telnet backdoor. This grants root shell access, enabling complete compromise of the device, including potential network pivoting and disruption of network services. The vulnerability affects confidentiality, integrity, and availability of the device and connected network segments.

The device is End-of-Life and will not receive patches or official fixes. Mitigation requires discontinuing use of the affected hardware or isolating it from untrusted local networks to prevent unauthorized access. Network segmentation or disabling telnet access (if possible) may reduce exposure, but no vendor-supported remediation exists.