Critical D-Link Router RCE Under Active Exploitation - No

Critical D-Link Router Vulnerability Under Active Exploitation

A critical command injection vulnerability (CVE-2026-0625) affecting multiple D-Link DSL router models is being actively exploited in the wild. The affected devices have reached end-of-life status, meaning no security patches will be released.

Vulnerability Details

Technical Analysis

The vulnerability exists in the dnscfg.cgi endpoint, which fails to properly sanitize user input before passing it to system commands.

Vulnerable Code Path

HTTP Request → dnscfg.cgi → DNS Configuration Handler
                                    ↓
                           Command Construction
                                    ↓
                           system() call ← INJECTION POINT
                                    ↓
                           Shell Command Execution

Proof of Concept

The vulnerability is exploited by appending shell metacharacters (;, |, or $()) to the dnsPrimary CGI parameter of the /cgi-bin/dnscfg.cgi endpoint. The injected commands execute as root since the CGI handler passes unsanitized input directly to a system() call.

PoC details redacted — the exploit is trivial and targets EOL devices with no available patches. See the NVD entry for technical details.

Note: Unauthorized access to systems you do not own is illegal.

Exploitation Result

Successful exploitation grants:

• Root shell access on the router
• Full control of network traffic
• Ability to modify DNS settings (for MitM attacks)
• Pivot point for internal network attacks
• Persistence through firmware modification

Affected Models

The following D-Link DSL router models are confirmed vulnerable:

Active Exploitation

Threat actors are actively scanning for and exploiting this vulnerability:

Observed Attack Patterns

1. Mass Scanning
   - Shodan/Censys queries for vulnerable models
   - Port 80/8080 scanning for web interfaces
 
2. Exploitation
   - Automated exploitation scripts
   - DNS hijacking for credential theft
   - Botnet recruitment (Mirai variants)
 
3. Post-Exploitation
   - DNS poisoning → Banking trojans
   - Traffic interception → Credential harvesting
   - Lateral movement into internal networks

Estimated Exposure

Based on internet scanning data:

Immediate Actions Required

Option 1: Replace the Device (Recommended)

Replace affected routers with supported models:

Recommended Replacements:

• TP-Link Archer AX21 (Budget)
• ASUS RT-AX86U (Mid-range)
• Ubiquiti Dream Machine (Advanced)

Option 2: Temporary Mitigations

If immediate replacement isn't possible:

1. Disable Remote Management
   - Access router admin panel
   - Disable WAN-side management access
   - Disable all remote access features
 
2. Network Isolation
   - Place router behind another firewall
   - Block inbound access to ports 80, 443, 8080
 
3. MAC Filtering
   - Enable and configure MAC address filtering
   - Only allow known devices
 
4. Monitor for Compromise
   - Check DNS settings regularly
   - Monitor for unusual traffic patterns
   - Review connected devices list

Compromise Detection

Check if your router has been compromised:

# From a device on the network, check DNS settings
nslookup google.com
# If IP doesn't match Google's known IPs, DNS may be hijacked
 
# Check for unexpected DNS servers
# Windows:
ipconfig /all | findstr "DNS"
 
# Linux/macOS:
cat /etc/resolv.conf

Indicators of Compromise

DNS Hijacking Indicators

Malicious DNS Servers Observed:
- 185.XXX.XXX.XXX
- 91.XXX.XXX.XXX
- 103.XXX.XXX.XXX
 
Domains Used for C2:
- update-router[.]com
- dns-config[.]net
- router-admin[.]xyz

Network Indicators

• Unexpected outbound connections to Eastern European IPs
• Increased DNS query volume
• Failed HTTPS certificate warnings on banking sites
• Slow internet speeds (traffic interception)

Long-term Recommendations

1. Asset Inventory: Maintain inventory of all network devices
2. Lifecycle Management: Replace devices before EOL
3. Network Segmentation: Isolate IoT/network devices
4. Monitoring: Deploy network detection tools
5. Vulnerability Scanning: Regular scans for exposed management interfaces

References

• The Hacker News - D-Link DSL Router RCE
• D-Link Security Advisory
• CISA Alert - D-Link Vulnerabilities
• National Vulnerability Database - CVE-2026-0625

Last updated: January 18, 2026