CVE-2026-0625: D-Link Router Auth Bypass Vulnerability

CVE-2026-0625 Overview

Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device's DNS settings without valid credentials, enabling DNS hijacking ("DNSChanger") attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

Critical Impact

Unauthenticated attackers can hijack DNS settings on vulnerable D-Link devices, enabling man-in-the-middle attacks, credential theft, and redirection of all network traffic to malicious infrastructure. All affected devices are end-of-life with no patches available.

Affected Products

• D-Link DSL Series Routers
• D-Link DIR Series Routers
• D-Link DNS Series Network Storage Devices

Discovery Timeline

• 2025-11-27 - Exploitation evidence observed by the Shadowserver Foundation
• 2026-01-05 - CVE CVE-2026-0625 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-0625

Vulnerability Analysis

This vulnerability stems from missing authentication (CWE-306) in the dnscfg.cgi endpoint present in the web management interface of multiple D-Link router and NAS devices. The endpoint, intended for DNS configuration management, fails to verify that incoming requests originate from authenticated administrative sessions. This architectural flaw allows any network-adjacent or internet-facing attacker to directly interact with critical DNS settings without presenting valid credentials.

The attack surface is particularly concerning because many consumer routers expose their management interfaces to the WAN by default or through misconfiguration. Once an attacker accesses the vulnerable endpoint, they gain full control over the device's DNS resolver settings, which affects all connected clients on the local network.

Root Cause

The root cause is a fundamental design flaw in the access control implementation for the dnscfg.cgi CGI script. The web server handling requests to this endpoint does not enforce session validation or authentication checks before processing DNS configuration changes. This allows the endpoint to be accessed directly without traversing the normal login workflow, completely bypassing the authentication mechanism intended to protect administrative functions.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by sending crafted HTTP requests directly to the dnscfg.cgi endpoint on a vulnerable device. The attack flow typically involves:

1. Scanning for vulnerable D-Link devices with exposed management interfaces
2. Sending direct requests to the dnscfg.cgi endpoint to enumerate current DNS settings
3. Submitting malicious DNS server addresses through the same endpoint
4. Device begins resolving DNS queries through attacker-controlled servers

Once DNS settings are modified, the attacker can intercept sensitive traffic, serve phishing pages for legitimate domains, inject malicious content, or conduct credential harvesting attacks against all users on the affected network. The "GhostDNS" malware campaign demonstrated large-scale exploitation of this exact vulnerability class, compromising hundreds of thousands of routers in targeted geographic regions.

Detection Methods for CVE-2026-0625

Indicators of Compromise

• Unexpected DNS server addresses configured on D-Link devices (particularly servers not belonging to your ISP or known DNS providers like 8.8.8.8, 1.1.1.1)
• HTTP requests to dnscfg.cgi endpoints in router access logs, especially from external IP addresses
• DNS resolution anomalies where legitimate domains resolve to unexpected IP addresses
• Certificate warnings when accessing banking, email, or other sensitive sites (indicating potential man-in-the-middle)
• Network traffic logs showing connections to known GhostDNS infrastructure

Detection Strategies

• Monitor network traffic for unauthorized HTTP requests to D-Link router management ports (typically 80, 8080, or 443)
• Implement DNS monitoring to detect changes in resolver configuration on network devices
• Deploy network intrusion detection signatures for dnscfg.cgi access patterns
• Regularly audit DNS settings on all network infrastructure devices against known-good baselines
• Use passive DNS monitoring to identify anomalous resolution behavior across the network

Monitoring Recommendations

• Configure alerts for any access attempts to router management interfaces from external networks
• Implement centralized logging for all network device configuration changes
• Deploy SentinelOne Singularity platform for endpoint protection to detect malware leveraging DNS hijacking techniques
• Monitor for connections to known malicious DNS servers associated with GhostDNS campaigns
• Conduct periodic automated audits of DNS configurations across all managed network devices

How to Mitigate CVE-2026-0625

Immediate Actions Required

• Replace all affected D-Link DSL/DIR/DNS devices immediately as they are end-of-life and will not receive security patches
• Disable remote management (WAN-side access) on all affected devices until replacement
• Verify and document current DNS settings on all network devices to establish a baseline
• Block external access to router management interfaces using upstream firewall rules
• Configure network clients to use hardcoded DNS servers rather than DHCP-provided settings where possible

Patch Information

No patches are available for CVE-2026-0625. D-Link has designated all affected products as end-of-life/end-of-service, meaning they will not receive security updates. The vendor's security advisories (SAP10068, SAP10118, SAP10488) recommend replacing affected hardware with current-generation products that receive active security support.

Workarounds

• Disable the remote management interface entirely to prevent WAN-side exploitation
• Place vulnerable devices behind a properly configured firewall that blocks access to management ports
• Segment networks to limit the blast radius if a router is compromised
• Configure upstream DNS filtering to block known malicious DNS servers
• Consider deploying third-party firmware (such as OpenWrt or DD-WRT) if supported, though this removes vendor support

# Example: Block external access to router management ports at upstream firewall
# Note: Replace 192.168.1.1 with your router's IP address

# iptables rules to block WAN access to management interface
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -i eth0 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -i eth0 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 8080 -i eth0 -j DROP

# Verify DNS settings haven't been tampered with
# Manual verification steps for D-Link devices:
# 1. Access router web interface from LAN only
# 2. Navigate to Setup > Internet Setup > DNS Settings
# 3. Verify DNS servers match expected values (ISP or trusted public DNS)