Hackers Exploit Zero-Day in Discontinued D-Link Devices

SecurityWeek reports that an OS command injection vulnerability in discontinued D-Link gateway devices has been exploited in the wild as a zero-day. Tracked as CVE-2026-0625 (CVSS 9.3), the flaw arises because the dnscfg.cgi library does not properly sanitise user-supplied DNS configuration parameters, allowing remote unauthenticated attackers to inject and execute arbitrary shell commands.

The affected endpoint is associated with unauthenticated DNS modification behaviour described by D-Link, with active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 to 2019, according to VulnCheck. Based on data from The Shadowserver Foundation, CVE-2026-0625 has been exploited in the wild since late November 2025.

D-Link states that the confirmed vulnerable models are legacy DSL gateway appliances that were discontinued more than five years ago, and there will be no patch; owners should retire them and replace them with supported models.