D-Link dnscfg.cgi Auth Bypass in DSL/DIR/DNS Router
CVE-2026-0625 Published on January 5, 2026

D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the devices DNS settings without valid credentials, enabling DNS hijacking (DNSChanger) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-0625 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Weakness Type

Missing Authentication for Critical Function

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Products Associated with CVE-2026-0625

Want to know whenever a new CVE is published for D-Link products? stack.watch will email you.

D-Link Dir 600

D-Link Dsl 2640b Firmware

D-Link Dsl 2740r Firmware

D-Link Dsl 2740r

D-Link Dsl 2640t

D-Link Dsl 2640t Firmware

Affected Versions

D-Link DSL-2640B:

Version 0 is affected.

D-Link DSL-2740R:

Version 0 is affected.

D-Link DSL-2780B:

Version 0 is affected.

D-Link DSL-526B:

Version 0 is affected.

D-Link DSL-2640T:

Version 0 is affected.

D-Link DSL-500:

Version 0 is affected.

D-Link DSL-500G:

Version 0 is affected.

D-Link DSL-502G:

Version 0 is affected.

D-Link DIR-905L:

Version 0 is affected.

D-Link DIR-600:

Version 0 is affected.

D-Link DIR-608:

Version 0 is affected.

D-Link DIR-610:

Version 0 is affected.

D-Link DIR-611:

Version 0 is affected.

D-Link DIR-615:

Version 0 is affected.

D-Link DNS-320:

Version 0 is affected.

D-Link DNS-325:

Version 0 is affected.

D-Link DNS-345:

Version 0 is affected.

Exploit Probability

EPSS

0.96%

Percentile

58.01%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.