CVE-2026-0625

CVE-2026-0625 is a critical authentication bypass and improper access control vulnerability affecting multiple end-of-life D-Link DSL/DIR/DNS devices. It allows unauthenticated attackers to directly access and modify DNS settings via the dnscfg.cgi endpoint, enabling DNS hijacking attacks. With a CVSS score of 9.3 (Critical), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, as it can redirect user traffic to malicious infrastructure. Active exploitation has been observed by the Shadowserver Foundation, and D-Link previously reported its leverage by the "GhostDNS" malware ecosystem. There is significant community discussion and media coverage, indicating high awareness, despite no public exploit code being readily available.