CVE-2026-0625: Critical Actively Exploited RCE Hits Unpatchable D-Link Routers

CVE-2026-0625 is a critical remote code execution vulnerability in legacy D-Link DSL routers that is being actively exploited in the wild, leaving thousands of unpatchable devices wide open to total compromise. The flaw resides in the router’s DNS configuration interface, specifically the dnscfg.cgi endpoint, and allows an unauthenticated attacker to inject and execute arbitrary shell commands through the web interface.

Security researchers noted a CVSS v4.0 score of 9.3, underscoring the immediate danger to users still relying on ageing hardware. The Shadowserver Foundation first observed evidence of active exploitation on 27 November 2025, and according to VulnCheck, the issue stems from improper input sanitisation.

The vulnerability affects DSL-526B (Firmware ≤ 2.01), DSL-2640B (Firmware ≤ 1.07), DSL-2740R (Firmware < 1.17), and DSL-2780B (Firmware ≤ 1.01.14), with D-Link having declared these models End of Life in early 2020 and no security patches planned; the only viable fix is to replace the hardware with a modern, supported device.