---
cve: "CVE-2026-0625"
severity: "CRITICAL"
cvss: 9.3
epss: "1%"
vendor: "D-Link"
kev: false
exploited: false
published: "2026-01-05 22:15:54"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-24T00:16:30+02:00"
---

# CVE-2026-0625

> 9.3 CRITICAL

## Beschreibung

Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-05-25 23:41:34
- CNA-CVSS: **9.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-306** — Missing Authentication for Critical Function
  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

## Angriffsmuster (CAPEC)

- [CAPEC-12 — Choosing Message Identifier](https://capec.mitre.org/data/definitions/12.html) _(Severity: High)_
- [CAPEC-36 — Using Unpublished Interfaces or Functionality](https://capec.mitre.org/data/definitions/36.html) _(Severity: High)_
- [CAPEC-62 — Cross Site Request Forgery](https://capec.mitre.org/data/definitions/62.html) _(Severity: Very High)_
- [CAPEC-166 — Force the System to Reset Values](https://capec.mitre.org/data/definitions/166.html) _(Severity: Medium)_
- [CAPEC-216 — Communication Channel Manipulation](https://capec.mitre.org/data/definitions/216.html)

## BSI-Hinweise (deutsch)

- [D-LINK Router: Schwachstelle ermöglicht Codeausführung](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-0024) — _BSI-Einstufung: kritisch_
  Ein entfernter, anonymer Angreifer kann eine Schwachstelle in D-LINK Router ausnutzen, um beliebigen Programmcode auszuführen.

## Referenzen

- <https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10488>
- <https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10068>
- <https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10118>
- <https://www.vulncheck.com/advisories/dlink-dsl-command-injection-via-dns-configuration-endpoint>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-0625/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_