D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| D-Link | DSL-2640B | all versions | — | No fix listed | CNA |
| D-Link | DSL-2740R | all versions | — | No fix listed | CNA |
| D-Link | DSL-2780B | all versions | — | No fix listed | CNA |
| D-Link | DSL-526B | all versions | — | No fix listed | CNA |
| D-Link | DSL-2640T | all versions | — | No fix listed | CNA |
| D-Link | DSL-500 | all versions | — | No fix listed | CNA |
| D-Link | DSL-500G | all versions | — | No fix listed | CNA |
| D-Link | DSL-502G | all versions | — | No fix listed | CNA |
| D-Link | DIR-905L | all versions | — | No fix listed | CNA |
| D-Link | DIR-600 | all versions | — | No fix listed | CNA |
| D-Link | DIR-608 | all versions | — | No fix listed | CNA |
| D-Link | DIR-610 | all versions | — | No fix listed | CNA |
| D-Link | DIR-611 | all versions | — | No fix listed | CNA |
| D-Link | DIR-615 | all versions | — | No fix listed | CNA |
| D-Link | DNS-320 | all versions | — | No fix listed | CNA |
| D-Link | DNS-325 | all versions | — | No fix listed | CNA |
| D-Link | DNS-345 | all versions | — | No fix listed | CNA |
- DSL-2640B VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DSL-2740R VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DSL-2780B VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DSL-526B VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DSL-2640T VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DSL-500 VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DSL-500G VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DSL-502G VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DIR-905L VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DIR-600 VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DIR-608 VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DIR-610 VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DIR-611 VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DIR-615 VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DNS-320 VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DNS-325 VendorD-Link Affected all versions Fixed in — No fix listed CNA
- DNS-345 VendorD-Link Affected all versions Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 3
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:* | — | — | D-Link Japan K.K. |
| cpe:2.3:o:dlink:dir-615_firmware:*:*:*:*:*:*:*:* | — | — | D-Link Japan K.K. |
| cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:* | — | — | D-Link Japan K.K. |
- cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
- cpe:2.3:o:dlink:dir-615_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
- cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-0625
- 2026-10-03 Alias added: GHSA-v9p2-66r4-9qhr
References
More D-Link vulnerabilities
- TI-2024-03070 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection KEVCVSS 3.1CRITICAL 9.8
- TI-2024-03069 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials KEVCVSS 3.1CRITICAL 9.8
- TI-2024-00708 D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal KEVCVSS 3.1CRITICAL 9.8
- TI-2023-10693 OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-17249 D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-09657 D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE)… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-0625 · CVE Program
- CVE-2026-0625 · NVD
- FIRST EPSS
- GHSA-v9p2-66r4-9qhr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences