Multiple D-Link router models are under active exploitation as threat actors leverage command injection vulnerabilities to hijack DNS settings and compromise home networks.
Security researchers have confirmed ongoing attacks targeting unpatched consumer routers, with campaigns dating back to 2016 and continuing through 2019.
Attack Campaign Details
The attacks primarily exploit command injection flaws in D-Link DSL router models deployed outside the United States.
Attackers have been hijacking DNS traffic by manipulating router configurations, redirecting users to malicious websites without their knowledge.
Security firm Proofpoint initially identified malvertising campaigns targeting home routers, affecting both Windows and Android devices connected to compromised networks.
Troy Mursch from Bad Packets documented persistent DNS hijacking campaigns specifically targeting consumer routers.
Hackers have even abused Google Cloud Platform infrastructure to coordinate attacks against vulnerable D-Link devices.
| Model | Hardware Revision | Region | Affected Firmware | Fixed Firmware | Status |
| DSL-526B | All Revision B | Australia | AU v2.01 and older | N/A | Under Investigation |
| DSL-2640B | All Revision T | Malaysia | GE v1.07 and older | N/A | Under Investigation |
| DSL-2740R | All Revision A | Europe | EU v1.15 and older | EU_1.17 | Patched (01/2015) |
| DSL-2780B | All Revision A | AU/NZ/EU | v1.01.14 and older | N/A | Under Investigation |
These models were deployed with region-specific firmware not available on the standard D-Link support portal.
Some devices were distributed directly by internet service providers with custom configurations.
Mitigation Steps
- Contact Your ISP: If the router was provided by your carrier, request firmware updates directly from them.
- Factory Reset: Access the web interface at http://192.168.0.1, perform a factory reset, and set a strong, unique password.
- Change DNS Settings: Manually configure trusted DNS servers through the router’s web interface:
- Google DNS: 8.8.8.8 or 8.8.4.4
- Cloudflare DNS: 1.1.1.1
- Link emphasizes that installing firmware not intended for specific regions may disable devices or compromise security further.
Users should consult regional D-Link support for appropriate patches and avoid using incompatible firmware versions.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
