External risk intelligence

D-Link DNS Configuration Bypass Allows DNS Hijacking

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-0625

The vulnerability affects consumer and carrier routers at a network-facing endpoint used for configuration. These devices are typically deployed at the internet edge, and the specific endpoint allows for unauthenticated access, making the configuration surface directly reachable from the public internet in common deployment patterns.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in D-Link devices could allow unauthenticated attackers to alter DNS settings, potentially redirecting user traffic to malicious websites. This issue was previously linked to malware that targeted consumer and carrier routers. The affected products are considered end-of-life and no longer receive security updates, but exploitation evidence was recently observed.

Attackers can change DNS settings without credentials.
Consumer and carrier routers could be compromised.
Confirm relevance and exposure of end-of-life devices.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can directly access a device's DNS configuration by targeting a specific web endpoint. This allows them to alter DNS settings and redirect internet traffic to malicious sites. The vulnerability primarily affects older D-Link devices that are no longer supported with security updates.

No authentication required for access.
Triggered by accessing the dnscfg.cgi endpoint.
Enables DNS hijacking attacks.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in D-Link devices allows unauthenticated attackers to bypass authentication and improperly control DNS settings. When supported by the advisory, this could lead to DNS hijacking, redirecting user traffic to malicious sites.

DNS settings and user traffic.
Direct access to the dnscfg.cgi endpoint.
DNS hijacking and traffic redirection.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts D-Link devices, and given their consumer and carrier router nature, ownership likely resides with network or infrastructure teams responsible for internet-facing edge devices, potentially coordinated with vendor-management teams due to the end-of-life status. The first practical step involves identifying deployed D-Link devices, assessing their network exposure and criticality, and confirming the accountable owner for remediation planning, considering these devices are no longer supported.

Network and infrastructure teams own the issue.
Verify device exposure and business criticality.
Plan for replacement or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link hardware affected by CVE-2026-0625?

These are D-Link DSL, DIR, and DNS series devices. These products historically served as routers for homes, small businesses, and carrier networks, acting as the gateway between local devices and the internet. Because these specific models have reached their end-of-life, the manufacturer no longer provides firmware updates to patch security gaps.

What does this vulnerability mean in plain English?

This is an authentication bypass, classified as CWE-306 (Missing Authentication for Critical Function). It means the device's security system fails to verify who is asking to change settings. In CVE-2026-0625, this flaw allows anyone to reach a specific configuration page and alter DNS settings, essentially letting an outsider take control of where your internet traffic goes.

How is this vulnerability triggered?

An attacker triggers the issue by directly sending a request to the 'dnscfg.cgi' endpoint on the affected device. Because the device does not require login credentials for this specific page, the action succeeds immediately. Notably, this does not require local access or physical interaction; the request can be sent over the network if the device is reachable.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates the vulnerability is very likely to pose a risk because these routers are typically deployed at the internet edge. Since the affected endpoint is network-facing, devices connected directly to the public internet are exposed. Internal devices that are shielded from the public web may have a lower immediate risk profile.

What should I do if I am running these D-Link devices?

Since these products are no longer supported, you cannot apply a security update. Your first step is to identify where these devices are currently in use within your network. Assess whether they are internet-facing and prioritize them for replacement, as they can no longer be secured against this type of unauthorized configuration change.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.