CVE-2026-0625— D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint

D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint

Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

关键功能的认证机制缺失

D-Link多款产品 访问控制错误漏洞

D-Link DSL-2740R等都是中国友讯（D-Link）公司的产品。D-Link DSL-2740R是一款高性能 ADSL 路由器。D-Link DSL-2640B是一款无线ADSL路由宽带猫。D-Link DSL-2780B是一款无线ADSL路由宽带猫。 D-Link多款产品存在访问控制错误漏洞，该漏洞源于dnscfg.cgi端点对用户提供的DNS配置参数清理不当，可能导致远程命令执行。以下产品受到影响：D-Link DSL-2740R、DSL-2640B、DSL-2780B和DSL-526B。

N/A

N/A