Loading story…
A critical command injection vulnerability, tracked as CVE-2026-0625, has been discovered in multiple legacy D-Link DSL gateway routers. The flaw resides in the dnscfg.cgi endpoint, where improper input sanitization allows unauthenticated remote attackers to execute arbitrary shell commands via DNS configuration parameters. Security researchers from VulnCheck and The Shadowserver Foundation have confirmed active exploitation attempts, with evidence captured on honeypots and reports of ongoing campaigns targeting affected devices. The impacted models include DSL-526B (≤ 2.01), DSL-2640B (≤ 1.07), DSL-2740R (< 1.17), and DSL-2780B (≤ 1.01.14), all of which have reached end-of-life and will not receive security updates.
D-Link has acknowledged the vulnerability and is working to determine if additional products are affected, citing challenges in identifying all impacted models due to firmware variations. The company strongly advises users to retire and replace vulnerable devices, as no patches will be issued. The vulnerability is rated as critical (CVSS 9.3), and exploitation has been observed in the wild, though the specific threat actors and targets remain unclear. The risk is heightened by the unauthenticated nature of the exploit and the widespread use of these legacy routers in consumer environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
D-Link confirmed several impacted router models are end-of-life and will not receive security updates for the vulnerability. The vendor advised customers to replace unsupported devices with supported models instead of انتظار patches.
Public proof-of-concept exploit code for CVE-2026-0625 was made available on GitHub, lowering the barrier to exploitation. Reporting also recommended mitigations such as disabling remote administration, restricting management access, and replacing affected devices.
CVE-2026-0625 was disclosed as a critical command injection vulnerability in the dnscfg.cgi endpoint of multiple D-Link DSL gateways, allowing unauthenticated remote code execution. Public reporting noted a CVSS 4.0 score of 9.3 and active exploitation in the wild.
Following the report from VulnCheck, D-Link began reviewing firmware across its product lines to determine the full scope of impacted devices and versions. The company indicated it was still investigating because firmware variations made identification difficult.
After exploitation was observed, VulnCheck notified D-Link about the command injection issue affecting legacy DSL routers. SecurityAffairs states this report was made on December 16, 2025.
The Shadowserver Foundation detected exploitation attempts against the vulnerable dnscfg.cgi endpoint in late November 2025, providing evidence that the issue was being actively exploited in the wild. One report specifically dates this activity to November 27, 2025.
Several affected D-Link DSL gateway models, including DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B, were declared end-of-life in early 2020. Their unsupported status later meant no security patches would be issued for CVE-2026-0625.
Attack activity abusing similar unauthenticated DNS configuration weaknesses in D-Link routers was documented from at least 2016 through 2019 and beyond, including DNSChanger-style campaigns. Attackers used DNS hijacking to redirect traffic, distribute malware, and intercept communications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourcelinkedin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
D-Link DWR-M961 routers, hardware version `C1`, were found to contain **five critical vulnerabilities** that allow remote, unauthenticated attackers to execute arbitrary commands as root or crash the device. The issues affect firmware versions earlier than `1.1.5_C1_202607071108` and include three command injection flaws—`CVE-2026-71944` in `/boafrm/formLtefotaUpgradeQuectel` via `fota_url`, `CVE-2026-71955` in `/boafrm/formWsc` via fields including `localPin`, `targetAPSsid`, `peerPin`, and `peerRptPin`, and `CVE-2026-71956` in `app.cgi` via `netDig.ping.dst`—as well as two buffer overflows: `CVE-2026-71957` in `app.cgi` via `netAcc.addlist[].name` and `CVE-2026-71958` in `quicksetup.cgi` via `test4`, `ssid2`, and `username`. All five bugs carry a **CVSS 3.1 score of 9.8** and were classified under `CWE-78` for command injection or `CWE-120` for buffer overflow, reflecting high impact on confidentiality, integrity, and availability. Public reporting credited researchers **Jincheng Wang, Le Yu, and Xiapu Luo** with the discoveries, while D-Link released firmware `1.1.5_C1_202607071108` to address the flaws. Reporting at the time of disclosure said no active exploitation had been observed, and the vulnerabilities were also highlighted by regional CERT reporting on D-Link products.
Aug 16, 2026
ASUS has disclosed a critical authentication bypass vulnerability, tracked as CVE-2025-59367, affecting several of its DSL series router models, including DSL-AC51, DSL-N16, and DSL-AC750. This flaw allows remote, unauthenticated attackers to gain unauthorized access to unpatched devices exposed to the internet, with attacks requiring low complexity and no user interaction. ASUS has released firmware version 1.1.2.3_1010 to address the issue and strongly urges users to update their devices immediately. For users unable to update, ASUS recommends disabling all internet-accessible services such as remote WAN access, port forwarding, DDNS, VPN server, DMZ, port triggering, and FTP, as well as following best practices like using complex passwords and regularly checking for firmware updates. The vulnerability has been assigned a critical CVSS score of 9.3, highlighting the significant risk it poses to affected devices. While there are currently no reports of active exploitation, the nature of the flaw makes it a prime target for attackers seeking to compromise routers for use in botnets or DDoS attacks. Users of end-of-life models that will not receive firmware updates are especially urged to implement the recommended mitigations to reduce their exposure to potential attacks.
Jul 12, 2026
Two high-severity vulnerabilities, **CVE-2026-5983** and **CVE-2026-5984**, were disclosed in the unsupported **D-Link DIR-605L** router running firmware `2.13B01`. Both flaws are remote **buffer overflows** tied to POST request handlers exposed under `/goform/`, with the `curTime` argument identified as the attack vector. **CVE-2026-5983** affects the `formSetDDNS` function in `/goform/formSetDDNS`, while **CVE-2026-5984** affects the `formSetLog` function in `/goform/formSetLog`. The vulnerabilities are classified under **CWE-119** and **CWE-120** and carry high-impact CVSS assessments affecting confidentiality, integrity, and availability. The disclosures indicate that remote exploitation is possible and that a **public exploit** is available or has been disclosed, increasing the risk to internet-exposed devices. Because the DIR-605L is no longer supported by D-Link, organizations and users still operating the router face elevated exposure without an expected vendor fix.
Jun 29, 2026