ONGOING ATTACKS EXPLOITING CRITICAL RCE VULNERABILITY IN LEGACY D-LINK DSL ROUTERS

Summary from the TLDR InfoSec newsletter

CVE-2026-0625, a critical command injection vulnerability in legacy D-Link DSL routers' dnscfg.cgi endpoint, has been actively exploited in the wild since November 2025, targeting end-of-life models including DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B. The unauthenticated remote code execution flaw enables attackers to hijack DNS settings without credentials, allowing them to redirect traffic and persistently compromise all downstream devices behind the router. Organizations must immediately retire affected unpatchable devices and upgrade to actively supported models, as the vulnerability leverages the same DNS configuration mechanism used in previous large-scale DNSChanger campaigns.