Attackers Exploit Zero-Day in End-of-Life D-Link Routers

Attackers are actively exploiting a zero-day vulnerability in discontinued D-Link DSL gateway devices to run arbitrary shell commands, with most affected gateways being models no longer supported by D-Link for firmware updates. The flaw, designated CVE-2026-0625 and rated CVSS 9.3, affects the dnscfg.cgi endpoint that handles DNS server settings and allows remote code execution through unauthenticated input.

D-Link said it learned of the vulnerability from VulnCheck on 16 December 2025, and is conducting a firmware review while planning to publish a detailed list of affected models and firmware versions later this week, according to D-Link. VulnCheck noted that exploitation has been observed in production environments, including campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B and DSL-526B from 2016 to 2019.

In parallel, the US Cybersecurity and Infrastructure Security Agency added five such D-Link vulnerabilities to its Known Exploited Vulnerabilities Catalog in 2025.