{"id":"dlink-dsl-router-command-injection-jan-2026","category":"patch","status":"closed","title":"D-Link legacy DSL routers: CVE-2026-0625 command injection exploited, no fix for end-of-life models","tldr":"Attackers are exploiting CVE-2026-0625 in old D-Link DSL routers (DSL-526B, DSL-2640B, DSL-2740R, DSL-2780B). These models are end-of-life and get no fix. D-Link says to replace them. If you own one, swap it for a supported router.","summary":"D-Link disclosed CVE-2026-0625 on 6 January 2026. It is a command-injection flaw in the DNS-settings page (dnscfg.cgi) of several older DSL routers. An attacker who can reach the router's admin interface can run commands on it without logging in. The Shadowserver Foundation saw exploitation from late November 2025, and VulnCheck reported attacks in the wild in mid-December. D-Link names the DSL-526B, DSL-2640B, DSL-2740R and DSL-2780B. Its advisory also lists other legacy models, including DSL-500 series, DIR-600 series and DIR-905L devices, in connection with older DNS-changing malware families. All of these are end-of-life, and D-Link has published no fixed firmware. It says owners should retire and replace them. VulnCheck notes that most home setups only allow admin access from inside the home network, so an attack would likely need remote administration switched on or a booby-trapped web page. It is not known who is behind the attacks. D-Link says it is still reviewing other firmware builds.","action":"If you own a D-Link DSL-526B, DSL-2640B, DSL-2740R or DSL-2780B, or another old D-Link DSL or DIR router, replace it with a supported model. Until then, turn off remote administration, change the admin password, and check the router's DNS settings for servers you don't recognise.","product":"D-Link legacy DSL routers (DSL-526B, DSL-2640B, DSL-2740R, DSL-2780B)","audience":"home","severity":"critical","patch":"none","exploited":true,"cves":["CVE-2026-0625"],"tags":["d-link","router","dsl","command-injection","end-of-life","exploited","dns-hijacking"],"affected":["DSL-526B firmware 2.01 and earlier","DSL-2640B firmware 1.07 and earlier","DSL-2740R firmware earlier than 1.17","DSL-2780B firmware 1.01.14 and earlier","Other legacy D-Link models listed in SAP10488 (DSL-500 series, DSL-2640T, DIR-600/608/610/611/615, DIR-905L, ShareCenter), all end-of-life"],"fixed":[],"matches":[{"platform":"router","app":"D-Link DSL-526B","bundle":"","fixed":""},{"platform":"router","app":"D-Link DSL-2640B","bundle":"","fixed":""},{"platform":"router","app":"D-Link DSL-2740R","bundle":"","fixed":""},{"platform":"router","app":"D-Link DSL-2780B","bundle":"","fixed":""}],"sources":[{"kind":"advisory","title":"D-Link security advisory SAP10488","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488","by":"D-Link","date":"2026-01-06"},{"kind":"news","title":"New D-Link flaw in legacy DSL routers actively exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/new-d-link-flaw-in-legacy-dsl-routers-actively-exploited-in-attacks/","by":"BleepingComputer","date":"2026-01-06"}],"started":"2026-01-06","closed":"2026-01-07","created":"2026-11-03T21:39:11.521Z","updated":"2026-11-03T21:39:11.521Z","cve_notes":[{"cve":"CVE-2026-0625","name":"Command injection in D-Link DSL router DNS settings","what":"A command-injection flaw in the DNS-configuration page (dnscfg.cgi) of old D-Link DSL routers that lets an unauthenticated attacker run commands on the router, and is being used in attacks, with no fix for these end-of-life models.","severity":"critical","cvss":9.3}],"timeline":[{"at":"2026-01-07","added":"2026-11-03T21:37:06.107Z","kind":"vendor-revised","text":"D-Link updated the advisory. It still names no fixed firmware, says it is still reviewing firmware builds, and says models cannot reliably be identified by model number alone.","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488","by":"D-Link","patch":"none"},{"at":"2026-01-06","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"BleepingComputer reported the attacks. It said it was unclear who was exploiting the flaw or which targets they chose, and that the four named models reached end-of-life in 2020.","url":"https://www.bleepingcomputer.com/news/security/new-d-link-flaw-in-legacy-dsl-routers-actively-exploited-in-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-01-06","added":"2026-11-03T21:37:06.107Z","kind":"disclosed","text":"D-Link published advisory SAP10488 for CVE-2026-0625, covering DSL-526B, DSL-2640B, DSL-2740R and DSL-2780B. All are end-of-life with no firmware fix, and D-Link recommends replacing them.","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488","by":"D-Link","patch":"none"},{"at":"2025-12-16","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"VulnCheck reported active exploitation and D-Link began investigating the same day. BleepingComputer says VulnCheck told D-Link on 15 December, so the sources differ by a day.","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488","by":"D-Link","patch":null},{"at":"2025-11-27","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"The Shadowserver Foundation recorded evidence of exploitation of the flaw, according to D-Link's later advisory.","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488","by":"D-Link","patch":null}],"url":"https://hard.fyi/live/dlink-dsl-router-command-injection-jan-2026/","json":"https://hard.fyi/api/live?id=dlink-dsl-router-command-injection-jan-2026"}