CVE-2026-0625
A command-injection flaw in the DNS-configuration page (dnscfg.cgi) of old D-Link DSL routers that lets an unauthenticated attacker run commands on the router, and is being used in attacks, with no fix for these end-of-life models.
If you own a D-Link DSL-526B, DSL-2640B, DSL-2740R or DSL-2780B, or another old D-Link DSL or DIR router, replace it with a supported model. Until then, turn off remote administration, change the admin password, and check the router's DNS settings for servers you don't recognise.
- Affects
- D-Link legacy DSL routers (DSL-526B, DSL-2640B, DSL-2740R, DSL-2780B)
- Severity
- Critical · CVSS 9.3
- Fixed in
- No fix yet
- Being used in attacks
- Not known to be
- Made public
- 6 Jan 2026
Part of: D-Link legacy DSL routers: CVE-2026-0625 command injection exploited, no fix for end-of-life models
D-Link disclosed CVE-2026-0625 on 6 January 2026. It is a command-injection flaw in the DNS-settings page (dnscfg.cgi) of several older DSL routers. An attacker who can reach the router's admin interface can run commands on it without logging in. The Shadowserver Foundation saw exploitation from late November 2025, and VulnCheck reported attacks in the wild in mid-December. D-Link names the DSL-526B, DSL-2640B, DSL-2740R and DSL-2780B. Its advisory also lists other legacy models, including DSL-500 series, DIR-600 series and DIR-905L devices, in connection with older DNS-changing malware families. All of these are end-of-life, and D-Link has published no fixed firmware. It says owners should retire and replace them. VulnCheck notes that most home setups only allow admin access from inside the home network, so an attack would likely need remote administration switched on or a booby-trapped web page. It is not known who is behind the attacks. D-Link says it is still reviewing other firmware builds.
Sources
- D-Link security advisory SAP10488D-Link · 6 Jan 2026
- New D-Link flaw in legacy DSL routers actively exploited in attacksBleepingComputer · 6 Jan 2026