CVE-2026-42376

D-Link DIR-456U Hardware Revision A1 End-of-Life, EOL contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /etc/init0.d/S80telnetd.sh with the username "Alphanetworks" and the static password "whdrv01dlobdir456U" read from /etc/config/imagesign. The custom telnetd...

The vulnerabilities of the components /etc/config/image_sign and /etc/alpha_config/image_sign in the microprogramming software of D-Link routers such as D-Link DIR-600 B1, D-Link DIR-890L A1, D-Link DIR-615 J1, D-Link DIR-645 A1, D-Link DIR-815 A1, D-Link DIR-823 A1, D-Link DIR-842 C1 allow attackers to increase their privileges.

The vulnerability of the components /etc/config/imagesign and /etc/alphaconfig/imagesign in the microprogramming software of D-Link DIR-600 B1, DIR-890L A1, DIR-615 J1, DIR-645 A1, DIR-815 A1, DIR-823 A1, and DIR-842 C1 is related to the use of pre-installed registration data. Exploiting this...

CVE-2019-18852

Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/imagesign or /etc/alphaconfig/imagesign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 for DCN, DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842...

Hardcoded credentials

Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/imagesign or /etc/alphaconfig/imagesign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 for DCN, DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842...