D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- D-Link DSL-2640B
0
- D-Link DSL-2740R
0
- D-Link DSL-2780B
0
- D-Link DSL-526B
0
- D-Link DSL-2640T
0
- D-Link DSL-500
0
- D-Link DSL-500G
0
- D-Link DSL-502G
0
- D-Link DIR-905L
0
- D-Link DIR-600
0
- D-Link DIR-608
0
- D-Link DIR-610
0
- D-Link DIR-611
0
- D-Link DIR-615
0
- D-Link DNS-320
0
- D-Link DNS-325
0
- D-Link DNS-345
0