VulnHub

Real-time Cybersecurity News

Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers

The Hacker News
Actively Exploited
CVEVulnerabilityRCECritical

Overview

A serious security vulnerability has been identified in legacy D-Link DSL gateway routers, specifically affecting the 'dnscfg.cgi' endpoint. This flaw, known as CVE-2026-0625, has a high severity score of 9.3 and allows unauthenticated remote attackers to execute commands through improper handling of user-provided DNS configuration inputs. Current reports indicate that this vulnerability is actively being exploited in the wild, putting users of these older routers at risk. It is crucial for individuals and organizations using these devices to be aware of the potential for unauthorized access and control. The situation underscores the need for users to assess their network security and consider upgrading their hardware to mitigate these risks.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: D-Link DSL gateway routers (specific models not specified)
  • Action Required: Users should upgrade to the latest firmware provided by D-Link for their specific router models.
  • Timeline: Newly disclosed

Original Article Summary

A newly discovered critical security flaw in legacy D-Link DSL gateway routers has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0625 (CVSS score: 9.3), concerns a case of command injection in the "dnscfg.cgi" endpoint that arises as a result of improper sanitization of user-supplied DNS configuration parameters. "An unauthenticated remote attacker can inject

Impact

D-Link DSL gateway routers (specific models not specified)

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should upgrade to the latest firmware provided by D-Link for their specific router models. If firmware is not available, consider replacing the router with a newer model that has active support and security updates.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, RCE, and 1 more.

Read Original Article

Related Coverage

Verizon outage affects over 2 million users: What 'SOS' means, refunds, more updates

Latest news

Verizon experienced a significant outage affecting over 2 million users across the United States, causing many to see an 'SOS' signal on their devices. This outage has raised concerns as it disrupted voice and data services for a considerable number of customers. While the exact cause of the outage has not been detailed, it is essential for users to remain informed about the situation as it develops. Verizon has acknowledged the issue and is working to restore services as quickly as possible. Users may want to check their accounts for potential refunds or credits due to the service disruption, especially if they rely heavily on their phones for work or communication.

Jan 15, 2026

Alleged Dell data compromise raises skepticism

SCM feed for Latest

A recent report has cast doubt on the authenticity of a claimed data breach involving Dell. The incident allegedly compromised a database containing over 5,000 records, which include emails from more than 2,000 employees. However, security experts and researchers are questioning the validity of this breach, suggesting the information may not be as serious as it appears. If true, this situation could expose sensitive employee data, raising concerns about privacy and security within the company. As investigations continue, it remains essential for organizations to remain vigilant about potential data breaches and to verify claims before reacting.

Jan 15, 2026

Exposed Target source code legitimate, employees say

SCM feed for Latest

Recent reports confirm that internal source code and documentation from Target Corporation has been exposed on the public software development platform Gitea. Current and former employees verified the authenticity of the leaked materials, raising concerns about potential security vulnerabilities and misuse of sensitive information. The exposure of this source code could allow malicious actors to exploit weaknesses in Target's systems, potentially leading to data breaches or other security incidents. This situation not only affects Target but also raises alarms for customers and partners who rely on the company for secure transactions. It highlights the ongoing risks associated with software development platforms and the importance of securing proprietary code.

Jan 15, 2026

Intensified curtailment of North Korean cyber threats sought by US

SCM feed for Latest

The U.S. is calling on United Nations member states to strengthen sanctions against North Korea, particularly targeting its IT worker scheme and cryptocurrency thefts. These activities are believed to finance North Korea’s nuclear and ballistic missile programs. By pressuring other nations to take action, the U.S. aims to limit North Korea's ability to fund its military ambitions through cybercrime. This situation raises concerns among international cybersecurity experts, as North Korean cyber operations have become increasingly sophisticated and threatening. The focus on sanctions reflects a broader strategy to curb the regime's funding sources and deter its aggressive military posture.

Jan 15, 2026

AsyncRAT campaign exploits Cloudflare services to hide attacks

SCM feed for Latest

Researchers have identified a malware campaign utilizing AsyncRAT, a remote access tool, which is being cleverly masked by cybercriminals through Cloudflare's services. By using Cloudflare’s free-tier offerings and TryCloudflare tunneling domains, attackers are able to host malicious WebDAV servers. This tactic allows them to hide their operations behind a trusted infrastructure, making detection more difficult. The campaign raises significant concerns for organizations relying on Cloudflare, as it shows how legitimate services can be exploited for malicious purposes. Companies must remain vigilant and enhance their security measures to counteract such deceptive tactics that can lead to unauthorized access and data breaches.

Jan 15, 2026

South Korean giant Kyowon confirms data theft in ransomware attack

BleepingComputer

The Kyowon Group, a major South Korean conglomerate, has confirmed that it fell victim to a ransomware attack that has significantly disrupted its operations. During this incident, customer information may have been compromised, raising concerns about potential identity theft and fraud. The company is currently investigating the extent of the data breach and working to restore its systems. This attack not only affects Kyowon’s business operations but also puts its customers at risk as their personal data might be exposed. As cyberattacks become more frequent and sophisticated, businesses must prioritize cybersecurity measures to protect sensitive information.

Jan 14, 2026