CVE-2026-0625

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0625", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-05T20:59:29.705Z", "datePublished": "2026-01-05T21:14:48.992Z", "dateUpdated": "2026-05-25T23:41:34.467Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-25T23:41:34.467Z"}, "title": "D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device\u2019s DNS settings without valid credentials, enabling DNS hijacking (\u201cDNSChanger\u201d) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the \"GhostDNS\" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates.&nbsp;Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).<br>"}], "value": "Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device\u2019s DNS settings without valid credentials, enabling DNS hijacking (\u201cDNSChanger\u201d) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the \"GhostDNS\" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates.\u00a0Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC)."}], "affected": [{"defaultStatus": "unknown", "product": "DSL-2640B", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-2740R", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-2780B", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-526B", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-2640T", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-500", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-500G", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-502G", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-905L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-600", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-608", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-610", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-611", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-615", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DNS-320", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DNS-325", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DNS-345", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dsl-2640b_firmware:eu_4.01b:*:*:*:*:*:*:*"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dsl-2740r_firmware:uk_1.01:*:*:*:*:*:*:*"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:h:dlink:dsl-2740r:-:*:*:*:*:*:*:*"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:h:dlink:dsl-2640t:-:*:*:*:*:*:*:*"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dsl-2640t_firmware:-:*:*:*:*:*:*:*"}]}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "tags": ["unsupported-when-assigned", "x_known-exploited-vulnerability"], "source": {"discovery": "UNKNOWN"}, "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "D-Link Systems, Inc. recommends retiring these products and replacing them with products that receive firmware updates.<br>"}], "value": "D-Link Systems, Inc. recommends retiring these products and replacing them with products that receive firmware updates."}], "references": [{"tags": ["vendor-advisory", "mitigation"], "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488"}, {"tags": ["vendor-advisory"], "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068"}, {"tags": ["vendor-advisory"], "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint"}], "credits": [{"lang": "en", "value": "The Shadowserver Foundation", "type": "finder"}, {"lang": "en", "value": "VulnCheck", "type": "coordinator"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T17:34:19.015227Z", "id": "CVE-2026-0625", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T17:34:41.776Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0625", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T17:34:19.015227Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T17:29:40.527Z"}}], "cna": {"tags": ["unsupported-when-assigned", "x_known-exploited-vulnerability"], "title": "D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "The Shadowserver Foundation"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "D-Link", "product": "DSL-2640B", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DSL-2740R", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DSL-2780B", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DSL-526B", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DSL-2640T", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DSL-500", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DSL-500G", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DSL-502G", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DIR-905L", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DIR-600", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DIR-608", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DIR-610", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DIR-611", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DIR-615", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DNS-320", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DNS-325", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}, {"vendor": "D-Link", "product": "DNS-345", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "D-Link Systems, Inc. recommends retiring these products and replacing them with products that receive firmware updates.", "supportingMedia": [{"type": "text/html", "value": "D-Link Systems, Inc. recommends retiring these products and replacing them with products that receive firmware updates.<br>", "base64": false}]}], "references": [{"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488", "tags": ["vendor-advisory", "mitigation"]}, {"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068", "tags": ["vendor-advisory"]}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device\u2019s DNS settings without valid credentials, enabling DNS hijacking (\u201cDNSChanger\u201d) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the \"GhostDNS\" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates.\u00a0Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).", "supportingMedia": [{"type": "text/html", "value": "Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device\u2019s DNS settings without valid credentials, enabling DNS hijacking (\u201cDNSChanger\u201d) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the \"GhostDNS\" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates.&nbsp;Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dsl-2640b_firmware:eu_4.01b:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dsl-2740r_firmware:uk_1.01:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dsl-2740r:-:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dsl-2640t:-:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dsl-2640t_firmware:-:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-25T23:41:34.467Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0625", "state": "PUBLISHED", "dateUpdated": "2026-05-25T23:41:34.467Z", "dateReserved": "2026-01-05T20:59:29.705Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-01-05T21:14:48.992Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "DSL-2640B", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-2740R", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-2780B", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-526B", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-2640T", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-500", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-500G", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DSL-502G", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-905L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-600", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-608", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-610", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-611", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DIR-615", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DNS-320", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DNS-325", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}, {"defaultStatus": "unknown", "product": "DNS-345", "vendor": "D-Link", "versions": [{"status": "affected", "version": "0"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [{"sourceIdentifier": "disclosure@vulncheck.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device\u2019s DNS settings without valid credentials, enabling DNS hijacking (\u201cDNSChanger\u201d) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the \"GhostDNS\" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates.\u00a0Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC)."}, {"lang": "es", "value": "M\u00faltiples dispositivos D-Link DSL/DIR/DNS contienen una omisi\u00f3n de autenticaci\u00f3n y una vulnerabilidad de control de acceso inadecuado en el endpoint dnscfg.cgi que permite a un atacante no autenticado acceder a la funcionalidad de configuraci\u00f3n de DNS. Al solicitar directamente este endpoint, un atacante puede modificar la configuraci\u00f3n de DNS del dispositivo sin credenciales v\u00e1lidas, lo que permite ataques de secuestro de DNS (\u2019DNSChanger\u2019) que redirigen el tr\u00e1fico del usuario a infraestructura controlada por el atacante. En 2019, D-Link inform\u00f3 que este comportamiento fue aprovechado por el ecosistema de malware \u2019GhostDNS\u2019 dirigido a routers de consumo y de operadores. Todos los productos afectados fueron posteriormente designados como fin de vida \u00fatil/fin de servicio, y ya no reciben actualizaciones de seguridad. Se observ\u00f3 evidencia de explotaci\u00f3n por la Shadowserver Foundation el 27-11-2025 (UTC)."}], "id": "CVE-2026-0625", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0625", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T17:34:19.015227Z", "version": "2.0.3"}}]}, "published": "2026-01-05T22:15:54.483", "references": [{"source": "disclosure@vulncheck.com", "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068"}, {"source": "disclosure@vulncheck.com", "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118"}, {"source": "disclosure@vulncheck.com", "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T08:18:30.764516+00:00", "value": {"mitigation_remediation": ["Replace all affected D\u2011Link routers and DNS appliances with models that receive regular firmware updates and retire the end\u2011of\u2011life hardware.", "If replacement is not immediately possible, disable remote web management or restrict access to the router\u2019s console to the local network, eliminating exposure from external attackers.", "Implement network monitoring to detect abnormal DNS configuration changes or traffic routing to suspicious IP addresses, and configure alerts for unauthorized modifications to DNS settings."], "summary": {"action": "Retire Devices", "impact": "Potential DNS hijacking leading to traffic redirection"}, "threat_synthesis": {"affected_systems": "Affected devices include numerous consumer and carrier routers from D\u2011Link, such as the DIR\u2011600, DIR\u2011608, DIR\u2011610, DIR\u2011611, DIR\u2011615, DIR\u2011905L, DNS\u2011320, DNS\u2011325, DNS\u2011345, DSL\u20112640B, DSL\u20112640T, DSL\u20112740R, DSL\u20112780B, DSL\u2011500, DSL\u2011500G, DSL\u2011502G, and DSL\u2011526B. All of these models have reached end\u2011of\u2011life or end\u2011of\u2011service status and no longer receive firmware updates.", "description_and_impact": "A flaw in the dnscfg.cgi endpoint on D\u2011Link DSL, DIR, and DNS devices permits an unauthenticated user to alter DNS settings without valid credentials. This authentication bypass (CWE\u2011306) allows the attacker to modify the device\u2019s DNS configuration, redirecting all network traffic to malicious infrastructure. The vulnerability can be leveraged for DNS\u2011based hijacking, commonly referred to as \u201cDNSChanger.\u201d", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.3, indicating a high severity. The EPSS score is less than 1%, indicating low current exploitation probability, but evidence from the Shadowserver Foundation dated 2025\u201111\u201127 shows real\u2011world use of the flaw. The attack vector is straightforward: an unauthenticated HTTP request to the dnscfg.cgi interface on the device\u2019s management web server. No credentials or special privileges are required, and the exploit consists solely of sending a crafted request that changes the DNS settings. Based on the description, it is inferred that such a change can redirect traffic to attacker\u2011controlled servers, facilitating phishing or malware delivery if the user\u2019s traffic is diverted."}}}}, "created": "2026-01-06T14:16:33.511357+00:00", "updated": "2026-04-18T08:30:35.820763+00:00", "vendors": ["d-link", "d-link$PRODUCT$dsl-2640b", "d-link$PRODUCT$dsl-2740r", "d-link$PRODUCT$dsl-2780b", "d-link$PRODUCT$dsl-526b"]}