This vulnerability (CVE-2026-0625) involves missing authentication controls on the dnscfg.cgi endpoint of certain D-Link routers, including the DSL-2640B. An attacker can bypass authentication and directly access DNS configuration functions, allowing unauthorized modification of DNS settings. This can facilitate DNS hijacking attacks, redirecting users to attacker-controlled sites. The issue was publicly reported with a high CVSS score of 9.3 and has been exploited in the wild historically. The affected devices have been designated end-of-life and do not receive patches.

Successful exploitation allows unauthenticated attackers to change DNS settings on vulnerable routers, enabling DNS hijacking. This can lead to user traffic interception, redirection to malicious sites, and potential further compromise of user systems. Since the devices are end-of-life, no official security updates are available to remediate this vulnerability.

No patches or official fixes are available because all affected devices have reached end-of-life/end-of-service status. Users should replace vulnerable devices with supported models that receive security updates. Network administrators should consider isolating or discontinuing use of affected devices to prevent exploitation.