A critical command injection vulnerability is being actively exploited in the wild, targeting numerous legacy D-Link DSL routers and gateways.