CVE-2026-42376 describes a critical vulnerability in the D-Link DIR-456U A1 firmware where a hardcoded telnet backdoor is present. The telnet daemon starts at boot with a fixed username "Alphanetworks" and password "whdrv01_dlob_dir456U" stored in the device configuration. The custom telnet daemon accepts credentials via a command-line flag, and the login binary uses a simple string comparison for authentication. Successful exploitation grants an attacker on the local network root-level access to the device. The device is End-of-Life and no patches are available.

An attacker with local network access can authenticate to the device's telnet service using hardcoded credentials, gaining full root privileges. This compromises the device's confidentiality, integrity, and availability, allowing complete administrative control. Since the device is End-of-Life, no official fixes will be provided, leaving the vulnerability unmitigated.

No official patch or fix is available because the device is End-of-Life. Users should consider replacing the affected hardware with a supported model. Network segmentation to restrict local network access to the device and disabling telnet access if possible may reduce exposure, but these are not guaranteed mitigations given the hardcoded backdoor.