CVE-2026-0625 D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint
Unauthenticated attackers can bypass authentication to modify DNS settings on D-Link routers, enabling DNS hijacking attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-0625?
CVE-2026-0625 is a critical authentication bypass vulnerability in D-Link DIR-600, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Weakness: CWE-306
Which versions are affected by CVE-2026-0625?
How do I fix CVE-2026-0625?
No fix has been published for CVE-2026-0625 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-0625 being exploited?
There is no known exploitation of CVE-2026-0625 in the wild and no public exploit code.
Sources
Also known as GHSA-v9p2-66r4-9qhr.