New Command-Injection Flaw in Retired D-Link DSL Routers Raises Active Exploitation Concerns

New Command-Injection Flaw in Retired D-Link DSL Routers Raises Active Exploitation Concerns

Key Takeaways

• A command injection flaw in multiple end-of-life D-Link DSL routers is being exploited in the wild.
• Impacted models will not receive patches, forcing organizations to retire or isolate affected devices.
• Evidence suggests attackers may rely on browser-based vectors or misconfigured remote administration.

Threat actors are actively exploiting a command injection vulnerability affecting several D-Link DSL gateway routers that have been out of support for years. The issue centers on improper input sanitization in the dnscfg.cgi endpoint—effectively giving unauthenticated attackers a path to execute arbitrary commands through DNS configuration parameters.

Security firm VulnCheck identified the problem in mid-December after The Shadowserver Foundation detected an exploitation attempt on one of its honeypots. The technique observed had not been publicly documented previously, suggesting attackers are experimenting with adaptations rather than relying solely on familiar exploit kits.

The affected hardware list spans four models—DSL-526B, DSL-2640B, DSL-2740R, and DSL-2780B—running older firmware builds that were retired by 2020. D-Link confirmed the vulnerability in collaboration with VulnCheck, but the company noted the difficulty in mapping the full scale of exposure. Firmware variations across product generations create a tangle of edge cases, a common challenge with legacy networking devices produced over long cycles where divergent firmware branches complicate broad assessments.

None of these devices will receive patches. The vendor urges users to replace them outright with supported hardware. For commercial environments—especially SMBs relying on older DSL gear tucked into branch offices—this creates an urgent need to audit hardware inventories. Once a device hits end-of-life, it effectively becomes a permanent liability.

A critical factor in these attacks is access. According to VulnCheck, most consumer and SMB routers restrict administrative CGI endpoints like dnscfg.cgi to the local network. Consequently, attackers likely require a browser-based foothold or a device configured for remote administration to exploit the flaw. Despite best practices, many organizations inadvertently leave legacy router admin interfaces exposed to the internet.

D-Link has stated it is analyzing older firmware releases to determine if additional models are affected. However, there is no reliable way to identify impacted models without manually inspecting firmware—a reminder of how sprawling legacy hardware ecosystems can become. This raises a significant operational question: how can a business maintain visibility over outdated networking equipment when the vendor itself faces challenges doing so?

Some organizations lean on platforms like Wiz to help visualize exposure across cloud and on-prem assets, especially when older devices linger in network corners. While these tools are not designed to patch unsupported routers, they can help ensure businesses identify where such devices reside before they become active attack vectors.

The broader issue remains lifecycle management. End-of-life devices often persist well past their sunset dates because they continue to function, and replacement incurs costs and downtime. Yet, attackers view these aging systems as low-effort, high-return opportunities. With no patches forthcoming, these devices offer a stable foothold into networks that may otherwise be well-defended.

It remains unclear precisely who is exploiting this vulnerability or what their specific targets are. Early signs came from honeypot activity rather than a widespread campaign, indicating the situation could evolve. Historically, vulnerabilities in consumer-grade hardware left online attract botnet operators, but targeted intrusions remain a risk if remote administration is enabled.

For organizations still running these devices, the recommendations are strict. Replace the hardware entirely if possible. If immediate replacement is not feasible, segment the device into a non-critical network zone, disable remote administration, and apply the latest available firmware, even if that version is years old. Every incremental barrier helps reduce the attack surface.

D-Link has reiterated that end-of-life routers no longer receive security updates or maintenance. While this is standard policy, it is often overlooked until an exploit gains public attention. The takeaway is clear: unsupported networking gear introduces unacceptable risk in a production environment. When vulnerabilities emerge long after official retirement, the cost of maintaining legacy equipment becomes undeniable.