CVE-2026-0625 in DSL-2640B
Summary
by MITRE • 01/06/2026
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/27/2026
The vulnerability identified as CVE-2026-0625 represents a critical authentication bypass flaw affecting multiple D-Link DSL/DIR/DNS device models that has persisted despite the affected products being marked as end-of-life. This vulnerability resides within the dnscfg.cgi web endpoint which is designed to manage DNS configuration settings but fails to properly validate user authentication. The flaw allows unauthenticated attackers to directly access and manipulate DNS settings through simple HTTP requests, fundamentally undermining the device's security posture and creating a pathway for sophisticated man-in-the-middle attacks.
The technical implementation of this vulnerability stems from improper access control mechanisms within the web application layer of these network devices. The dnscfg.cgi endpoint lacks adequate authentication checks, permitting any remote attacker to submit HTTP requests that modify DNS server configurations without requiring valid credentials or session tokens. This represents a classic CWE-285: Improper Authorization vulnerability where the application fails to properly enforce access restrictions on privileged functions. The vulnerability enables attackers to perform DNS hijacking operations that redirect user traffic through malicious DNS servers, allowing for complete traffic interception and manipulation.
The operational impact of this vulnerability extends beyond simple configuration modification, as it provides attackers with the capability to execute DNSChanger-style attacks that can redirect all DNS queries from affected devices to attacker-controlled infrastructure. This enables sophisticated cybercriminal operations including credential theft, malware distribution, and surveillance activities. The 2019 revelation that this vulnerability was actively exploited by the "GhostDNS" malware ecosystem demonstrates the real-world threat level and the persistence of such attacks against legacy network infrastructure. The fact that these devices are no longer receiving security updates means that any organization or individual utilizing these products remains completely exposed to this threat vector.
The exploitation of CVE-2026-0625 aligns with several tactics described in the MITRE ATT&CK framework, particularly T1071.004: Application Layer Protocol - DNS and T1566: Phishing. Attackers can leverage this vulnerability to establish persistent command and control infrastructure while maintaining stealth through DNS tunneling techniques. The vulnerability's persistence despite end-of-life status indicates a significant gap in security monitoring and remediation practices within organizations that continue to operate legacy network equipment. Network defenders should implement proactive monitoring to detect unauthorized DNS configuration changes and establish network segmentation to limit the potential impact of successful exploitation. The vulnerability serves as a prime example of how end-of-life devices can continue to pose significant security risks to network infrastructure, emphasizing the importance of proper device lifecycle management and the dangers of operating unsupported network equipment in production environments.