Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers

A newly discovered critical security flaw in legacy D-Link DSL gateway routers has come under active exploitation in the wild, tracked as CVE-2026-0625 with a CVSS score of 9.3, and concerns a command injection in the dnscfg.cgi endpoint arising from improper sanitisation of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution, according to VulnCheck.

The affected endpoint is associated with unauthenticated DNS modification (“DNSChanger”) behaviour and campaigns targeting firmware variants of models DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B from 2016 through 2019. Shadowserver Foundation recorded exploitation attempts targeting CVE-2026-0625 on 27 November 2025, and D-Link has initiated an internal investigation after a report from VulnCheck on 16 December 2025, noting difficulties in reliably identifying affected models across firmware variations.

Given that these DSL gateway products have reached end-of-life, owners are advised to retire them and upgrade to devices that receive regular firmware and security updates, as the vulnerability cannot be patched on the affected models.