D-Link Routers Vulnerable to Takeover Via Exploit for Zero-Day

Researchers published a proof-of-concept exploit for a zero-day in D-Link DIR-X4860 routers that enables unauthenticated attackers who can reach the HNAP port to bypass authentication and perform command injection in /bin/prog.cgi, leading to root-level takeover; SSD Secure Disclosure reported the issue and publicized the exploit after D-Link failed to respond, and users are advised to disable remote management as a mitigation.