Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00425.

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
D-link Subscribe
Dsl-2640b Subscribe
Dsl-2740r Subscribe
Dsl-2780b Subscribe
Dsl-526b Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
D-link Subscribe
Dsl-2640b Subscribe
Dsl-2740r Subscribe
Dsl-2780b Subscribe
Dsl-526b Subscribe
Advisories

No advisories yet.

Fixes

Solution

D-Link Systems, Inc. recommends retiring these products and replacing them with products that receive firmware updates.

Workaround

No workaround given by the vendor.

References
Link Providers
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068 cve-icon cve-icon
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118 cve-icon cve-icon
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488 cve-icon cve-icon
https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint cve-icon cve-icon
History

Wed, 21 Jan 2026 03:15:00 +0900

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 09 Jan 2026 01:30:00 +0900

Type Values Removed Values Added
Weaknesses CWE-78

Fri, 09 Jan 2026 01:00:00 +0900

Type Values Removed Values Added
Description Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution. The affected endpoint is also associated with unauthenticated DNS modification (“DNSChanger”) behavior documented by D-Link, which reported active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 through 2019. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC). Affected devices were declared end-of-life/end-of-service in early 2020. Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Title D-Link DSL Command Injection via DNS Configuration Endpoint D-Link DSL/DIR/DNS Command Injection via DNS Configuration Endpoint
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A'}

Thu, 08 Jan 2026 01:30:00 +0900

Type Values Removed Values Added
References

Tue, 06 Jan 2026 23:30:00 +0900

Type Values Removed Values Added
First Time appeared D-link
D-link dsl-2640b
D-link dsl-2740r
D-link dsl-2780b
D-link dsl-526b
Vendors & Products D-link
D-link dsl-2640b
D-link dsl-2740r
D-link dsl-2780b
D-link dsl-526b

Tue, 06 Jan 2026 06:30:00 +0900

Type Values Removed Values Added
Description Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution. The affected endpoint is also associated with unauthenticated DNS modification (“DNSChanger”) behavior documented by D-Link, which reported active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 through 2019. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC). Affected devices were declared end-of-life/end-of-service in early 2020.
Title D-Link DSL Command Injection via DNS Configuration Endpoint
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-01-20T17:34:41.776Z

Reserved: 2026-01-05T20:59:29.705Z

Link: CVE-2026-0625

cve-icon Vulnrichment

Updated: 2026-01-20T17:29:40.527Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-01-05T22:15:54.483

Modified: 2026-01-08T18:09:23.230

Link: CVE-2026-0625

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-01-06T23:16:33Z

Weaknesses