D-Link legacy DSL routers: CVE-2026-0625 command injection exploited, no fix for end-of-life models
Attackers are exploiting CVE-2026-0625 in old D-Link DSL routers (DSL-526B, DSL-2640B, DSL-2740R, DSL-2780B). These models are end-of-life and get no fix. D-Link says to replace them. If you own one, swap it for a supported router.
If you own a D-Link DSL-526B, DSL-2640B, DSL-2740R or DSL-2780B, or another old D-Link DSL or DIR router, replace it with a supported model. Until then, turn off remote administration, change the admin password, and check the router's DNS settings for servers you don't recognise.
- D-Link DSL-526Bno fixed version yet
- D-Link DSL-2640Bno fixed version yet
- D-Link DSL-2740Rno fixed version yet
- D-Link DSL-2780Bno fixed version yet
What’s happening
D-Link disclosed CVE-2026-0625 on 6 January 2026. It is a command-injection flaw in the DNS-settings page (dnscfg.cgi) of several older DSL routers. An attacker who can reach the router's admin interface can run commands on it without logging in. The Shadowserver Foundation saw exploitation from late November 2025, and VulnCheck reported attacks in the wild in mid-December. D-Link names the DSL-526B, DSL-2640B, DSL-2740R and DSL-2780B. Its advisory also lists other legacy models, including DSL-500 series, DIR-600 series and DIR-905L devices, in connection with older DNS-changing malware families. All of these are end-of-life, and D-Link has published no fixed firmware. It says owners should retire and replace them. VulnCheck notes that most home setups only allow admin access from inside the home network, so an attack would likely need remote administration switched on or a booby-trapped web page. It is not known who is behind the attacks. D-Link says it is still reviewing other firmware builds.
- What
- Flaw
- Affects
- D-Link legacy DSL routers (DSL-526B, DSL-2640B, DSL-2740R, DSL-2780B)
- Affected
- DSL-526B firmware 2.01 and earlier
DSL-2640B firmware 1.07 and earlier
DSL-2740R firmware earlier than 1.17
DSL-2780B firmware 1.01.14 and earlier
Other legacy D-Link models listed in SAP10488 (DSL-500 series, DSL-2640T, DIR-600/608/610/611/615, DIR-905L, ShareCenter), all end-of-life - Fixed in
- No fix yet
- Since
- 6 Jan 2026
- Closed
- 7 Jan 2026
Timeline
- Vendor revisedNo fix yet
D-Link updated the advisory. It still names no fixed firmware, says it is still reviewing firmware builds, and says models cannot reliably be identified by model number alone.
- Update
BleepingComputer reported the attacks. It said it was unclear who was exploiting the flaw or which targets they chose, and that the four named models reached end-of-life in 2020.
- Made publicNo fix yet
D-Link published advisory SAP10488 for CVE-2026-0625, covering DSL-526B, DSL-2640B, DSL-2740R and DSL-2780B. All are end-of-life with no firmware fix, and D-Link recommends replacing them.
- Update
VulnCheck reported active exploitation and D-Link began investigating the same day. BleepingComputer says VulnCheck told D-Link on 15 December, so the sources differ by a day.
- Update
The Shadowserver Foundation recorded evidence of exploitation of the flaw, according to D-Link's later advisory.
Sources
- D-Link security advisory SAP10488D-Link · 6 Jan 2026
- New D-Link flaw in legacy DSL routers actively exploited in attacksBleepingComputer · 6 Jan 2026