CVE-2026-0625
published 2026-01-05CVE-2026-0625: Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an…
PriorityP187critical9.3CVSS 4.0
AVNACLATNPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.96%
57.5th percentile
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d-link | dir-600 | — | — |
| d-link | dir-608 | — | — |
| d-link | dir-610 | — | — |
| d-link | dir-611 | — | — |
| d-link | dir-615 | — | — |
| d-link | dir-905l | — | — |
| d-link | dns-320 | — | — |
| d-link | dns-325 | — | — |
| d-link | dns-345 | — | — |
| d-link | dsl-2640b | — | — |
| d-link | dsl-2640t | — | — |
| d-link | dsl-2740r | — | — |
| d-link | dsl-2780b | — | — |
| d-link | dsl-500 | — | — |
| d-link | dsl-500g | — | — |
| d-link | dsl-502g | — | — |
| d-link | dsl-526b | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploitation of this CVE may involve a browser-based (CSRF-style) attack or require the target device to be configured for remote administration — look for WAN-side requests to the CGI endpoint. ↗
- →The exploitation technique was not publicly documented prior to Shadowserver observation on 2025-11-27 UTC — treat any hits on /dnscfg.cgi from unauthenticated sources as high-confidence malicious activity. ↗
- →Successful exploitation enables arbitrary shell command injection and RCE — look for anomalous child processes spawned from web server or CGI processes on affected D-Link devices. ↗
- ·Most consumer router setups restrict access to CGI admin endpoints like /dnscfg.cgi to LAN only; exploitation from the WAN requires remote administration to be enabled, which should narrow the exposed attack surface. ↗
- ·No firmware patches will be issued for any affected devices as all confirmed models reached end-of-life since 2020. ↗
CVSS provenance
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
D-Link DSL-2640B/DSL-2740R/DSL-2780B/DSL-526B Endpoint dnscfg.cgi os command injection (EUVD-2026-0944)
vuldb·2026-05-27·CVSS 9.3
CVE-2026-0625 [CRITICAL] D-Link DSL-2640B/DSL-2740R/DSL-2780B/DSL-526B Endpoint dnscfg.cgi os command injection (EUVD-2026-0944)
A vulnerability, which was classified as critical, was found in D-Link DSL-2640B, DSL-2740R, DSL-2780B and DSL-526B. Affected by this vulnerability is an unknown functionality of the file dnscfg.cgi of the component Endpoint. Such manipulation leads to os command injection. This vulnerability only affects products that are no longer supported by the maintainer.
This vulnerability is traded as CVE-2026-0625. The attack may be launched remotely. Furthermore, there is an exploit available.
GHSA
GHSA-v9p2-66r4-9qhr: Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg
ghsa_unreviewed·2026-01-06
CVE-2026-0625 [CRITICAL] CWE-306 GHSA-v9p2-66r4-9qhr: Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg
Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution. The affected endpoint is also associated with unauthenticated DNS modification (“DNSChanger”) behavior documented by D-Link, which reported active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 through 2019. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC). Affected devices were declared end-of-life/end-of-service in early 2020.
VulnCheck
D-Link dir-600_firmware Missing Authentication for Critical Function
vulncheck·2026·CVSS 9.3
CVE-2026-0625 [CRITICAL] D-Link dir-600_firmware Missing Authentication for Critical Function
D-Link dir-600_firmware Missing Authentication for Critical Function
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was obse
No detection rules found.
No public exploits indexed.
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint
2026-01-05
Published
Exploited in the wild