Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01382.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
D-link
  • Dsl-2640b
  • Dsl-2740r
  • Dsl-2780b
  • Dsl-526b

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
D-link
  • Dsl-2640b
  • Dsl-2740r
  • Dsl-2780b
  • Dsl-526b
References
Link Providers
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068 cve-icon cve-icon
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118 cve-icon cve-icon
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488 cve-icon cve-icon
https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint cve-icon cve-icon
History

Thu, 08 Jan 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-78

Thu, 08 Jan 2026 16:00:00 +0000

Type Values Removed Values Added
Description Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution. The affected endpoint is also associated with unauthenticated DNS modification (“DNSChanger”) behavior documented by D-Link, which reported active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 through 2019. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC). Affected devices were declared end-of-life/end-of-service in early 2020. Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Title D-Link DSL Command Injection via DNS Configuration Endpoint D-Link DSL/DIR/DNS Command Injection via DNS Configuration Endpoint
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A'}

Wed, 07 Jan 2026 16:30:00 +0000

Type Values Removed Values Added
References

Tue, 06 Jan 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dsl-2640b
D-link dsl-2740r
D-link dsl-2780b
D-link dsl-526b
Vendors & Products D-link
D-link dsl-2640b
D-link dsl-2740r
D-link dsl-2780b
D-link dsl-526b

Mon, 05 Jan 2026 21:30:00 +0000

Type Values Removed Values Added
Description Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution. The affected endpoint is also associated with unauthenticated DNS modification (“DNSChanger”) behavior documented by D-Link, which reported active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 through 2019. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC). Affected devices were declared end-of-life/end-of-service in early 2020.
Title D-Link DSL Command Injection via DNS Configuration Endpoint
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-01-08T15:52:40.440Z

Reserved: 2026-01-05T20:59:29.705Z

Link: CVE-2026-0625

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-01-05T22:15:54.483

Modified: 2026-01-08T18:09:23.230

Link: CVE-2026-0625

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-01-06T14:16:33Z