The D-Link DIR-600L Hardware Revision B1 contains a hardcoded Telnet backdoor that is activated at boot. A fixed username and password are read from the internal configuration file and passed to a custom telnet daemon, which compares credentials using a simple string comparison. Because no authentication is required beyond the hardcoded credentials, an unauthenticated attacker on the local network can obtain a root shell and gain full administrative control over the device. The weakness is a hardcoded credential flaw (CWE-798).

This vulnerability affects the D-Link DIR-600L router running firmware on hardware revision B1. The device is End-of-Life and will not receive official updates from the vendor.

The CVSS score of 9.8 indicates critical severity, with full confidentiality, integrity, and availability compromise possible. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but the same hardcoded credentials can be used by any local network attacker. The likely attack vector is an attacker who can directly reach the device over the local network, such as through a compromised workstation or an open guest Wi-Fi. Given its critical score and the absence of a patch, the risk remains high until the device is replaced or isolated.