Zero-Day Vulnerability in Discontinued D-Link Routers Actively Exploited for Remote Code Execution and Botnet Attacks

Executive Summary

A critical zero-day vulnerability has been discovered and is being actively exploited in several discontinued D-Link router models, including the D-Link DIR-600, DIR-615, and DIR-825. This vulnerability, which enables remote code execution and authentication bypass via the device’s web management interface, exposes organizations to significant risk. Threat actors are leveraging this flaw to gain unauthorized access, deploy malware, and conscript devices into botnets for distributed denial-of-service (DDoS) attacks. The exploitation is widespread and opportunistic, with public proof-of-concept (POC) code available, and no official patches forthcoming due to the end-of-life status of the affected devices. Immediate action is required to mitigate exposure and prevent further compromise.

Threat Actor Profile

The exploitation of the D-Link zero-day is primarily being conducted by financially motivated cybercriminals and botnet operators. These actors are opportunistic, scanning the internet for exposed, vulnerable devices and rapidly incorporating them into malicious infrastructure. While there is no confirmed attribution to state-sponsored advanced persistent threat (APT) groups, the tactics, techniques, and procedures (TTPs) observed align with those previously used by groups such as APT28 and APT41 in Internet of Things (IoT) campaigns. The primary objectives are to establish persistence, expand botnet capabilities, and facilitate further attacks such as DDoS or lateral movement within compromised networks.

Technical Analysis of Malware/TTPs

The vulnerability in discontinued D-Link devices is typically a remote code execution (RCE) or authentication bypass flaw in the web management interface. Attackers exploit this by sending specially crafted HTTP requests that trigger buffer overflows or bypass authentication checks, allowing them to execute arbitrary commands as root. Publicly available POC exploits, such as those published on GitHub and security forums, demonstrate the ease with which attackers can compromise these devices.

Once access is gained, threat actors deploy lightweight malware payloads designed for persistence and stealth. These payloads often establish communication with command-and-control (C2) servers, download additional modules, and modify device configurations to maintain access. In many cases, compromised routers are enrolled into botnets, such as Mirai-like variants, which are then used for large-scale DDoS attacks or as proxies for further malicious activity.

The exploitation chain typically follows these MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts, if credentials are harvested), T1059 (Command and Scripting Interpreter), and T1210 (Exploitation of Remote Services). Attackers may also attempt to pivot from the compromised router into internal networks, seeking additional targets or sensitive data.

Exploitation in the Wild

Security researchers and threat intelligence platforms have observed a significant uptick in scanning and exploitation attempts targeting legacy D-Link routers worldwide. The attacks are not limited to any specific region or sector; rather, they are opportunistic, affecting any organization or individual with exposed, unsupported D-Link devices. Indicators of compromise (IOCs) include unusual outbound traffic, unexpected processes or files on the device, and connections to known botnet C2 infrastructure.

Public POCs and exploit scripts have been widely disseminated, lowering the barrier to entry for less sophisticated attackers. Reports on platforms such as GitHub, Twitter, and Reddit detail active exploitation, with some devices observed participating in coordinated DDoS attacks or serving as relay points for further malicious activity. The inclusion of this vulnerability in the CISA Known Exploited Vulnerabilities Catalog underscores the urgency and scale of the threat.

Victimology and Targeting

The exploitation of discontinued D-Link devices is indiscriminate and global. Victims include small and medium-sized businesses, home users, and enterprises that have not decommissioned legacy hardware. There is no evidence of targeted campaigns against specific industries or geographies; rather, attackers are leveraging automated tools to identify and compromise any vulnerable device accessible from the internet. The primary risk is to organizations that have not maintained an accurate asset inventory or have failed to replace unsupported network infrastructure, leaving them exposed to compromise, data exfiltration, and service disruption.

Mitigation and Countermeasures

Organizations must take immediate steps to mitigate the risk posed by this zero-day vulnerability in discontinued D-Link devices. The most effective countermeasure is to replace all unsupported D-Link routers with current, vendor-supported hardware that receives regular security updates. Where immediate replacement is not feasible, disable remote management interfaces, restrict access to device management ports using network-level controls, and segment IoT devices from critical business networks.

Continuous monitoring for unusual outbound traffic and device behavior is essential to detect potential compromise. Apply strict firewall rules to limit exposure, and ensure that all network devices are included in asset inventories and vulnerability management programs. Decommissioning legacy hardware should be a standard policy to prevent similar risks in the future.

References

CISA Known Exploited Vulnerabilities Catalog, NVD - National Vulnerability Database, GitHub POC Example, D-Link Security Advisories, LinkedIn Security Community Discussions, Reddit r/netsec Thread, dbugs.ptsecurity.com technical write-up, runZero D-Link router blog, SecurityAffairs D-Link RCE, GitHub Advisory, Twitter IOC/Exploit threads, runZero

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to identify, assess, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and continuous monitoring capabilities empower security teams to proactively manage vulnerabilities and reduce exposure to emerging threats. For more information or to discuss your organization’s risk posture, we are happy to answer questions at ops@rescana.com.