Filtered by vendor Dlink Subscriptions
Filtered by product Dsl-2640b Firmware Subscriptions

Search

Switch to Advanced Search (Beta)
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-0625 2 D-link, Dlink 9 Dsl-2640b, Dsl-2740r, Dsl-2780b and 6 more 2026-03-05 N/A
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
CVE-2012-1308 1 Dlink 2 Dsl-2640b, Dsl-2640b Firmware 2025-04-11 N/A
Cross-site request forgery (CSRF) vulnerability in redpass.cgi in D-Link DSL-2640B Firmware EU_4.00 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter.
CVE-2020-9279 1 Dlink 2 Dsl-2640b, Dsl-2640b Firmware 2024-11-21 9.8 Critical
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device.
CVE-2020-9278 1 Dlink 2 Dsl-2640b, Dsl-2640b Firmware 2024-11-21 9.1 Critical
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL.
CVE-2020-9277 1 Dlink 2 Dsl-2640b, Dsl-2640b Firmware 2024-11-21 9.8 Critical
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks (e.g., modify the admin password) with no authentication.
CVE-2020-9276 1 Dlink 2 Dsl-2640b, Dsl-2640b Firmware 2024-11-21 8.8 High
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The function do_cgi(), which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with CVE-2020-9277.
CVE-2020-9275 1 Dlink 2 Dsl-2640b, Dsl-2640b Firmware 2024-11-21 9.8 Critical
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A cfm UDP service listening on port 65002 allows remote, unauthenticated exfiltration of administrative credentials.