The vulnerability is a telnet daemon that starts automatically when the DIR‑456U A1 firmware boots. The daemon uses a fixed username, "Alphanetworks", and a static password, "whdrv01_dlob_dir456U", read from a configuration file, and the login routine verifies them with a simple string comparison. Because the credentials are hard‑coded and no further authentication is required, an attacker who can reach the device on the local network can obtain a root shell, giving full administrative control. This represents a hard‑coded credential weakness (CWE‑798) that leads to remote code execution.

Affected devices are D‑Link DIR‑456U routers, revision A1. The hardware is End‑of‑Life and will no longer receive security updates. No specific firmware version is listed; the device simply runs the legacy A1 firmware that includes the backdoor logic.

The CVSS score of 9.8 classifies this as critical. No EPSS score is available, but the trivial authentication and direct root access make exploitation highly likely, especially in environments where the router is connected to untrusted networks. The vulnerability is not listed in the CISA KEV catalog, yet the straightforward local‑network attack path makes it attractive to adversaries.