A flaw in the dnscfg.cgi endpoint on D‑Link DSL, DIR, and DNS devices permits an unauthenticated user to alter DNS settings without valid credentials. This authentication bypass (CWE‑306) allows the attacker to modify the device’s DNS configuration, redirecting all network traffic to malicious infrastructure. The vulnerability can be leveraged for DNS‑based hijacking, commonly referred to as “DNSChanger.”

Affected devices include numerous consumer and carrier routers from D‑Link, such as the DIR‑600, DIR‑608, DIR‑610, DIR‑611, DIR‑615, DIR‑905L, DNS‑320, DNS‑325, DNS‑345, DSL‑2640B, DSL‑2640T, DSL‑2740R, DSL‑2780B, DSL‑500, DSL‑500G, DSL‑502G, and DSL‑526B. All of these models have reached end‑of‑life or end‑of‑service status and no longer receive firmware updates.

The vulnerability carries a CVSS score of 9.3, indicating a high severity. The EPSS score is less than 1%, indicating low current exploitation probability, but evidence from the Shadowserver Foundation dated 2025‑11‑27 shows real‑world use of the flaw. The attack vector is straightforward: an unauthenticated HTTP request to the dnscfg.cgi interface on the device’s management web server. No credentials or special privileges are required, and the exploit consists solely of sending a crafted request that changes the DNS settings. Based on the description, it is inferred that such a change can redirect traffic to attacker‑controlled servers, facilitating phishing or malware delivery if the user’s traffic is diverted.