CVE-2026-42375 identifies a critical vulnerability in the D-Link DIR-600L A1 firmware where a hardcoded telnet backdoor exists. The device starts a telnet daemon at boot with a fixed username and password stored in the firmware. Authentication uses a simple string comparison, and successful login grants root-level access without prior authentication. This vulnerability allows an unauthenticated attacker on the local network to gain full control of the device. The product is End-of-Life, and no official patch or remediation is available.

An attacker with local network access can exploit the hardcoded credentials to gain root shell access on the affected device. This grants full administrative privileges, enabling complete control over the device's configuration and operation. The vulnerability poses a critical risk to confidentiality, integrity, and availability of the device and potentially the network it is connected to. Since the device is End-of-Life, no vendor patch will be provided, leaving the vulnerability unmitigated by official updates.

No official patch or fix is available as the device has reached End-of-Life. Mitigation requires replacing the affected hardware with a supported device that does not contain this vulnerability. Network segmentation to isolate the device and disabling telnet access where possible may reduce exposure, but these are partial mitigations. Users should consider device replacement as the primary remediation.