A security researcher has published a proof-of-concept exploit showing that the D-Link DSL2600U router leaks its admin configuration credentials through an unprotected endpoint.
The vulnerability, reported on May 2, 2026, targets the router’s rom-0 file. This file contains the full configuration including admin credentials, and it’s accessible without authentication by simply fetching the /rom-0 path from the web interface. The attacker — Amir Hossein Jamshidi — demonstrated that the config can be decompressed using LZS decompression and the admin password extracted with a simple regex pattern.
The affected hardware runs firmware version v1.08 of the DSL-2600U. On Ubuntu-based testing, the exploit retrieves the plaintext admin password in seconds.
This is a classic information disclosure issue with no real complexity. Anyone with network access to the router can grab the config file. No fancy exploitation chain needed — just a GET request.
If you’re running this router, change the admin password (which won’t help if the endpoint is still exposed) or better yet, replace the hardware. D-Link has a long history of unpatched vulnerabilities on legacy devices, and this one doesn’t look different.
