Log in Start free

Vulnerability · Published Jan 5, 2026 · Assigned by VulnCheck

CVE-2026-0625D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint

Critical 9.3

In plain English

A critical-severity missing authentication in DIR-600 from D-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)1.0%top 37.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

Affected products (as reported)

VendorProductVersions
D-Link DSL-2640B 0
D-Link DSL-2740R 0
D-Link DSL-2780B 0
D-Link DSL-526B 0
D-Link DSL-2640T 0
D-Link DSL-500 0
D-Link DSL-500G 0
D-Link DSL-502G 0
D-Link DIR-905L 0
D-Link DIR-600 0
D-Link DIR-608 0
D-Link DIR-610 0
D-Link DIR-611 0
D-Link DIR-615 0
D-Link DNS-320 0
D-Link DNS-325 0
D-Link DNS-345 0

Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References