D-Link Routers Under Attack as Command Injection Vulnerability Is Exploited

Multiple D-Link router models are under active exploitation as threat actors leverage command injection vulnerabilities to hijack DNS settings and compromise home networks.  

Security researchers have confirmed ongoing attacks targeting unpatched consumer routers, with campaigns dating back to 2016 and continuing through 2019. 

Attack Campaign Details

The attacks primarily exploit command injection flaws in D-Link DSL router models deployed outside the United States.  

Attackers have been hijacking DNS traffic by manipulating router configurations, redirecting users to malicious websites without their knowledge.  

Security firm Proofpoint initially identified malvertising campaigns targeting home routers, affecting both Windows and Android devices connected to compromised networks. 

Troy Mursch from Bad Packets documented persistent DNS hijacking campaigns specifically targeting consumer routers.  

Hackers have even abused Google Cloud Platform infrastructure to coordinate attacks against vulnerable D-Link devices. 

Model	Hardware Revision	Region	Affected Firmware	Fixed Firmware	Status
DSL-526B	All Revision B	Australia	AU v2.01 and older	N/A	Under Investigation
DSL-2640B	All Revision T	Malaysia	GE v1.07 and older	N/A	Under Investigation
DSL-2740R	All Revision A	Europe	EU v1.15 and older	EU_1.17	Patched (01/2015)
DSL-2780B	All Revision A	AU/NZ/EU	v1.01.14 and older	N/A	Under Investigation

These models were deployed with region-specific firmware not available on the standard D-Link support portal.  

Some devices were distributed directly by internet service providers with custom configurations. 

Mitigation Steps

1. Contact Your ISP: If the router was provided by your carrier, request  firmware updates directly from them.

2. Factory Reset: Access the web interface at http://192.168.0.1, perform a factory reset, and set a strong, unique password.

3. Change DNS Settings: Manually configure trusted DNS servers through the router’s web interface:

• Google DNS: 8.8.8.8 or 8.8.4.4

• Cloudflare DNS: 1.1.1.1

4. Link emphasizes that installing firmware not intended for specific regions may disable devices or compromise security further.

 Users should consult regional D-Link support for appropriate patches and avoid using incompatible firmware versions. 

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.