Critical command injection vulnerability in the dnscfg.cgi endpoint of legacy D-Link DSL routers caused by improper sanitization of user-supplied DNS configuration parameters. Allows unauthenticated remote attackers to inject and execute arbitrary shell commands, resulting in remote code execution. The vulnerability enables DNS hijacking and modification without credentials or user interaction, giving attackers control over DNS settings and ability to redirect, intercept, or block downstream traffic.