CVE-2026-0625 is an OS command injection vulnerability categorized under CWE-78, found in the dnscfg.cgi endpoint of D-Link DSL-2640B and related DSL gateway devices. The root cause is improper neutralization of special characters in user-supplied DNS configuration parameters, allowing attackers to inject arbitrary shell commands. The vulnerability is exploitable remotely without authentication or user interaction, making it highly dangerous. The affected endpoint is also linked to DNS modification attacks, known as “DNSChanger,” which have been actively exploited in the wild targeting multiple D-Link DSL models from 2016 to 2019. Despite the devices being declared end-of-life in early 2020, recent exploitation evidence from November 2025 indicates ongoing risks. The vulnerability has a CVSS 4.0 base score of 9.3, reflecting its critical nature with high impact on confidentiality, integrity, and availability. No patches or firmware updates have been provided by the vendor, leaving legacy devices vulnerable to remote code execution attacks that could lead to full device compromise, network infiltration, or DNS hijacking.

For European organizations, this vulnerability poses a significant threat, especially for those still using legacy D-Link DSL gateway devices in their network infrastructure. Successful exploitation can lead to complete device takeover, enabling attackers to manipulate DNS settings, redirect traffic, intercept sensitive data, or launch further attacks within the internal network. This can compromise confidentiality, integrity, and availability of organizational data and services. Critical infrastructure providers, small and medium enterprises, and residential ISPs relying on these devices are particularly at risk. The lack of vendor support and patches increases the likelihood of persistent exploitation. Additionally, DNS manipulation can facilitate phishing, malware distribution, and espionage campaigns targeting European entities. The ongoing exploitation evidence suggests that threat actors continue to leverage this vulnerability, underscoring the urgency for mitigation.

Given the absence of official patches, European organizations should prioritize immediate mitigation steps: 1) Identify and inventory all D-Link DSL-2640B and related affected models within their networks. 2) Replace end-of-life devices with modern, supported hardware that receives regular security updates. 3) If replacement is not immediately feasible, isolate vulnerable devices on segmented networks with strict access controls to limit exposure. 4) Disable remote management interfaces, especially those exposing the dnscfg.cgi endpoint, to prevent unauthenticated access. 5) Monitor network traffic for unusual DNS configuration changes or command injection indicators. 6) Employ network-level DNS filtering and anomaly detection to detect and block malicious DNS modifications. 7) Educate IT staff about the risks of legacy device usage and the importance of timely hardware upgrades. 8) Collaborate with ISPs and vendors to ensure secure configurations and firmware updates where possible.