Hackers actively exploit critical RCE flaw in legacy D-Link DSL routers

Threat actors are actively exploiting a critical remote code execution flaw tracked as CVE-2026-0625 in legacy D-Link DSL routers, with a CVSS score of 9.3, according to VulnCheck. The vulnerability stems from an improper sanitization in the dnscfg.cgi endpoint that allows unauthenticated attackers to inject and execute arbitrary shell commands, effectively enabling remote code execution in affected devices.

Shadowserver researchers detected exploitation on 27 November 2025, and experts note that the affected models include firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B, produced between 2016 and 2019, with the devices now at end-of-life status since 2020.

D-Link launched an internal probe after VulnCheck’s 16 December 2025 report and is reviewing models, with an updated list expected; the advisory SAP10488 acknowledges the difficulty in precisely identifying all impacted devices due to firmware variations. Given the obsolete nature of the routers, security guidance urges users to replace them with supported devices that receive updates.