D-Link DSL Command Injection via DNS Configuration Endpoint_CVE-2026-0625

9.3 / 10

CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution. The affected endpoint is also associated with unauthenticated DNS modification (“DNSChanger”) behavior documented by D-Link, which reported active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 through 2019. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC). Affected devices were declared end-of-life/end-of-service in early 2020.

AI Analysis

Command injection vulnerability in D-Link DSL gateway devices via the dnscfg.cgi endpoint, allowing remote code execution

Basic Information

ID CVE-2026-0625

Source VulnCheck

Published Jan 5, 2026 at 21:14

Affected Product

Vendor D-Link

Product DSL-2640B

Affected Versions D-Link DSL-2640B 0
D-Link DSL-2740R 0
D-Link DSL-2780B 0
D-Link DSL-526B 0

CWE Classification

CWE-78

AI Assessment

AI Score 9.3 / 10

AI Severity Critical

Vendor D-Link

Product DSL gateway devices (DSL-2640B, DSL-2740R, DSL-2780B, DSL-526B)

References

{
    "lastseen": "",
    "description": "Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution. The affected endpoint is also associated with unauthenticated DNS modification (\u201cDNSChanger\u201d) behavior documented by D-Link, which reported active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 through 2019. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC). Affected devices were declared end-of-life/end-of-service in early 2020.",
    "published": "2026-01-05T21:14:48.992Z",
    "modified": "2026-01-05T21:14:48.992Z",
    "type": "cve",
    "title": "D-Link DSL Command Injection via DNS Configuration Endpoint",
    "source": "VulnCheck",
    "references": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068\nhttps://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint",
    "id": "CVE-2026-0625",
    "bulletinFamily": "",
    "cwe": [
        "CWE-78"
    ],
    "cvelist": null,
    "sourceData": "D-Link DSL-2640B 0\nD-Link DSL-2740R 0\nD-Link DSL-2780B 0\nD-Link DSL-526B 0",
    "sourceHref": "",
    "cvss": {
        "score": 9.3,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "DSL-2640B",
    "version": "0",
    "vendor": "D-Link",
    "ai_description": "Command injection vulnerability in D-Link DSL gateway devices via the dnscfg.cgi endpoint, allowing remote code execution",
    "ai_severity": "Critical",
    "ai_vendor": "D-Link",
    "ai_product": "DSL gateway devices (DSL-2640B, DSL-2740R, DSL-2780B, DSL-526B)",
    "ai_version": "0",
    "ai_score": 9.3
}