The vulnerability is a hardcoded Telnet backdoor that is enabled at boot on the D-Link DIR‑600L Hardware Revision A1. The device launches a Telnet daemon (telnetd) with the fixed username Alphanetworks and the static password wrgn35_dlwbr_dir600l. Authentication is performed by a custom login binary that uses strcmp() to validate the credentials. An unauthenticated attacker who can reach the device on the local network can thus obtain a root shell, giving full administrative control over the router. This flaw is a classic example of CWE‑798 (Use of Hard‑coded Credentials).

This flaw affects D‑Link DIR‑600L firmware on the Hardware Revision A1. The product has reached end‑of‑life and is not supported by the vendor. No patch or firmware update exists for this version.

The CVSS score of 9.8 reflects the severity of the flaw. The EPSS score is not available, indicating that the exploitation probability is currently unknown or not publicly reported. The flaw is not in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an attacker on the local network who connects to the Telnet service using the embedded credentials. The backdoor credentials are embedded in the firmware and can be used without additional setup, making exploitation very straightforward. Because the device is EOL, the only long‑term mitigation is replacement; temporary measures include disabling the Telnet daemon or blocking port 23.