CVE-2026-42376Disclosure(dlink / dir-456u)

LOWCVSS 9.8 · CRITICAL

Signal is active with 5 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /etc/init0.d/S80telnetd.sh with the username "Alphanetworks" and the static password "whdrv01_dlob_dir456U" read from /etc/config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.

dlink CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-798

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dir-456u
dir-456u_firmware

Threat summary

7 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 3 classified signals
Peaked at 5 mentions on most recent observed day (2026-05-13)
7 total mentions across 2 days

Affected systems

Vendors

dlink

Products

dir-456udir-456u_firmware

2 versions affected across 2 products

Deep dive

Activity timeline7 mentions / 2d

Signal classification2 categories

Disclosure

457.1%

General

342.9%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-04	2	Disclosure1General1
2026-05-13	5	Disclosure3General2

Full discourse7 posts

Lyrie.ai@lyrie_ai148d
Disclosure
--- Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation. CVE: CVE-2026-42376 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The advisory confirms the existence of CVE-2026-42376 with a CVSS v3.1 score of 9.8 (critical severity), but no PoC, exploit tool, active exploitation evidence, or patch information is included.
1000035
210 followersView on X
Lyrie.ai@lyrie_ai148d
Disclosure
CRITICAL: CVE-2026-42376 (CVSS 9.8) — multiple products. CVE: CVE-2026-42376 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
A new critical vulnerability, CVE-2026-42376, has been announced with CVSS 9.8 severity. No proof of concept, exploit, patch, or active exploitation details are provided.
1000039
210 followersView on X
Lyrie.ai@lyrie_ai148d
Disclosure
CVE: CVE-2026-42376 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor.
Post summary
The post announces CVE-2026-42376 as a critical vulnerability in the D‑Link DIR‑456U, highlighting a hardcoded telnet backdoor and CVSS details, but offers no PoC, exploit code, patch information, or evidence of active exploitation.
1000040
210 followersView on X
Lyrie.ai@lyrie_ai148d
General
References CVE: CVE-2026-42376 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The snippet lists the CVE identifier, CVSS score, severity, and advisory status, but provides no additional context about exploitation, mitigation, or proof of concept.
1000042
210 followersView on X
Lyrie.ai@lyrie_ai148d
General
https://lyrie.ai/research/research/cve-2026-42376-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post merely links to a CVE advisory without providing additional information or indicators for exploitation, patching, or technical details.
0000025
210 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds156d
General
CVE-2026-42376 Hardcoded Telnet Backdoor with Root Access in D-Link DIR-456U Hardware Revision A1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42376
Post summary
The text cites a D‑Link router backdoor vulnerability but only supplies a brief description, with no evidence of exploitation tools, patches, or active attacks.
0000034
4.0K followersView on X
VulDB 🛡@vuldb157d
Disclosure
There is a new vulnerability with elevated criticality in D-Link DIR-456U A1 (CVE-2026-42376) https://vuldb.com/vuln/360991
Post summary
The text announces a new high‑criticality vulnerability (CVE‑2026‑42376) in the D‑Link DIR‑456U A1 router.
0000061
2.1K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	dlink	dir-456u	a1	-	-
OS	dlink	dir-456u_firmware	-	-	-

Explore more

Back to dashboard dlink CVEs dir-456u vulnerabilities

What researchers are saying

CVE-2026-42376

Lyrie.ai[verified]@lyrie_aiDisclosure

The advisory confirms the existence of CVE-2026-42376 with a CVSS v3.1 score of 9.8 (critical severity), but no PoC, exploit tool, active exploitation evidence, or patch information is included.

Lyrie.ai[verified]@lyrie_aiDisclosure

A new critical vulnerability, CVE-2026-42376, has been announced with CVSS 9.8 severity. No proof of concept, exploit, patch, or active exploitation details are provided.

Lyrie.ai[verified]@lyrie_aiDisclosure

The post announces CVE-2026-42376 as a critical vulnerability in the D‑Link DIR‑456U, highlighting a hardcoded telnet backdoor and CVSS details, but offers no PoC, exploit code, patch information, or evidence of active exploitation.

Lyrie.ai[verified]@lyrie_aiGeneral

The snippet lists the CVE identifier, CVSS score, severity, and advisory status, but provides no additional context about exploitation, mitigation, or proof of concept.

Lyrie.ai[verified]@lyrie_aiGeneral

The post merely links to a CVE advisory without providing additional information or indicators for exploitation, patching, or technical details.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text cites a D‑Link router backdoor vulnerability but only supplies a brief description, with no evidence of exploitation tools, patches, or active attacks.

VulDB 🛡@vuldbDisclosure

The text announces a new high‑criticality vulnerability (CVE‑2026‑42376) in the D‑Link DIR‑456U A1 router.