D-Link Legacy Router Flaw Exploited: CVE-2026-0625 Zero-Day Endangers Networks

In early January 2026, a critical security incident involving D-Link legacy DSL routers came to light as attackers actively exploited a command injection vulnerability tracked as CVE-2026-0625. The flaw, caused by improper input sanitization in the dnscfg.cgi endpoint of several out-of-support D-Link DSL gateway models, allowed unauthenticated remote attackers to execute arbitrary shell commands and potentially gain full control over affected devices. Although the exploit was first detected by Shadowserver Foundation honeypots, the method was not previously public, raising the risk of widespread attacks on consumer and small business network infrastructure. Impacted routers—including the DSL-526B, DSL-2640B, DSL-2740R, and DSL-2780B—are end-of-life and will not receive security updates, leaving users exposed unless devices are decommissioned or isolated.

This incident highlights the persistent risks associated with legacy, unsupported network hardware across both consumer and SMB environments, particularly as attackers increasingly exploit unpatched, remotely accessible routers. It underscores the urgent importance of retiring end-of-life devices or segmenting critical networks, as well as the need for improved asset management strategies in the face of rising supply-chain and infrastructure vulnerabilities.

Active exploitation of unpatched, end-of-life D-Link DSL routers demonstrates how outdated infrastructure remains a major security liability. With vendors unable to provide fixes and attackers leveraging recently discovered methods, any organizations or individuals using these routers face immediate risk of network compromise. The urgency stems from the opportunity for remote code execution, enabling attackers to infiltrate internal networks, pivot laterally, or stage further attacks undetected.