Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers

Summary: A critical command injection flaw in legacy D-Link DSL gateway routers, tracked as CVE-2026-0625 with a CVSS score of 9.3, is under active exploitation, allowing unauthenticated attackers to execute arbitrary shell commands through the dnscfg.cgi endpoint. The Shadowserver Foundation recorded exploitation attempts on November 27, 2025, and D-Link said it opened an internal investigation on December 16, 2025, after VulnCheck reported active exploitation, with an updated list of affected models expected later this week.
Why it matters: The affected DSL-2740R, DSL-2640B, DSL-2780B and DSL-526B models are end-of-life and unpatchable, and altered DNS entries can silently redirect, intercept or block traffic for every device behind the router.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-0625
Related: ⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026