CVE-2026-0625
Full vulnerability record from the local CVENow database.
Description
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-01-05 22:15:54.483000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-0625",
"sourceIdentifier": "[email protected]",
"published": "2026-01-05T22:15:54.483",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Deferred",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the \"GhostDNS\" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC)."
},
{
"lang": "es",
"value": "Múltiples dispositivos D-Link DSL/DIR/DNS contienen una omisión de autenticación y una vulnerabilidad de control de acceso inadecuado en el endpoint dnscfg.cgi que permite a un atacante no autenticado acceder a la funcionalidad de configuración de DNS. Al solicitar directamente este endpoint, un atacante puede modificar la configuración de DNS del dispositivo sin credenciales válidas, lo que permite ataques de secuestro de DNS (’DNSChanger’) que redirigen el tráfico del usuario a infraestructura controlada por el atacante. En 2019, D-Link informó que este comportamiento fue aprovechado por el ecosistema de malware ’GhostDNS’ dirigido a routers de consumo y de operadores. Todos los productos afectados fueron posteriormente designados como fin de vida útil/fin de servicio, y ya no reciben actualizaciones de seguridad. Se observó evidencia de explotación por la Shadowserver Foundation el 27-11-2025 (UTC)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "D-Link",
"product": "DSL-2640B",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DSL-2740R",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DSL-2780B",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DSL-526B",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DSL-2640T",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DSL-500",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DSL-500G",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DSL-502G",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DIR-905L",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DIR-600",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DIR-608",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DIR-610",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DIR-611",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DIR-615",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DNS-320",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DNS-325",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
},
{
"vendor": "D-Link",
"product": "DNS-345",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-01-20T17:34:19.015227Z",
"id": "CVE-2026-0625",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"references": [
{
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068",
"source": "[email protected]"
},
{
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118",
"source": "[email protected]"
},
{
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint",
"source": "[email protected]"
}
]
}