PT-2026-1338 · D Link · Dsl-526B+3

Vulncheck · Published 2026-01-05 · Updated 2026-04-04 · CVE-2026-0625

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions D-Link DSL-2640B versions ≤ 1.07 D-Link DSL-2740R versions < 1.17 D-Link DSL-2780B versions ≤ 1.01.14 D-Link DSL-526B versions ≤ 2.01 D-Link DSL gateway devices (affected versions not specified)

Description A critical remote code execution (RCE) vulnerability exists in multiple end-of-life D-Link DSL gateway routers. This flaw, tracked as CVE-2026-0625, stems from improper input sanitization within the dnscfg.cgi endpoint, allowing unauthenticated attackers to inject and execute arbitrary shell commands. This vulnerability has been observed in active exploitation campaigns since November 2025, mirroring past "DNSChanger" style attacks. Successful exploitation grants attackers full control of the device, potentially leading to DNS hijacking, traffic redirection, and the establishment of botnets. The dnscfg.cgi endpoint is responsible for DNS configuration. The vulnerability allows attackers to send requests disguised as DNS settings, enabling arbitrary command execution. Shadowserver Foundation observed exploitation evidence on 2025-11-27 (UTC).

Recommendations D-Link DSL-2640B versions ≤ 1.07: Replace the device with a supported model. D-Link DSL-2740R versions < 1.17: Replace the device with a supported model. D-Link DSL-2780B versions ≤ 1.01.14: Replace the device with a supported model. D-Link DSL-526B versions ≤ 2.01: Replace the device with a supported model. D-Link DSL gateway devices (affected versions not specified): Replace the device with a supported model.

Fix

RCE

OS Command Injection

Missing Authentication

Weakness Enumeration

CWE-78

CWE-306

Related Identifiers

BDU:2026-00124

CVE-2026-0625

Affected Products

Dsl-2640B

Dsl-2740R

Dsl-2780B

Dsl-526B

References · 70

• https://bdu.fstec.ru/vul/2026-00124 · Security Note
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0625 · Security Note
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488 · Vendor Advisory
• https://twitter.com/CCBalert/status/2008823443756650885 · Twitter Post
• https://t.me/pentestingnews/72144 · Telegram Post
• https://twitter.com/Cyberciaforge/status/2009160254005871057 · Twitter Post
• https://twitter.com/zeeshankghouri/status/2009301030249582829 · Twitter Post
• https://reddit.com/r/TechNadu/comments/1q6herb/multiple_legacy_dlink_dsl_router_models_are · Reddit Post
• https://twitter.com/VulmonFeeds/status/2008392160064754153 · Twitter Post
• https://twitter.com/ThreatSynop/status/2009043262296703113 · Twitter Post
• https://t.me/thehackernews/8159 · Telegram Post
• https://twitter.com/securityRSS/status/2008925798997119421 · Twitter Post
• https://twitter.com/DarkForgeNews/status/2039650191796482377 · Twitter Post
• https://twitter.com/CVEnew/status/2008346558669246732 · Twitter Post