CVE-2026-42374 identifies a critical vulnerability in the D-Link DIR-600L B1 firmware where a hardcoded telnet backdoor exists. The device launches a telnet daemon at boot using a custom binary that accepts a fixed username and password stored in a configuration file. Authentication bypass is trivial due to the static credentials and weak string comparison. This allows an unauthenticated attacker on the local network to gain root-level access. The device is End-of-Life, so no official patches or fixes are available from the vendor.

An attacker with local network access can exploit this vulnerability to gain root shell access on the affected device. This grants full administrative control, enabling potential unauthorized configuration changes, network traffic interception, or further lateral movement within the network. Given the critical CVSS score of 9.8, the impact is severe. No known exploits are reported in the wild yet.

Since the device is End-of-Life and no patches are available, mitigation requires discontinuing use of the affected hardware or isolating it from untrusted networks to prevent local network attackers from accessing the telnet backdoor. Network segmentation or disabling telnet access (if possible) may reduce risk. Users should consider replacing the device with a supported model that receives security updates.