DLink DSL-2640B Firmware EU 4.01B
Approved changes feed: RSS · Atom
cpe:2.3:o:dlink:dsl-2640b_firmware:eu_4.01b:*:*:*:*:*:*:*
part: o version: eu_4.01b update: *
| Vendor | Dlink (b610c9ff-f722-5d9d-a6df-9bee7f4d4b44) |
|---|---|
| Product | Dsl 2640B Firmware (69fff0f1-0110-5215-9478-25f83de25134) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-0625 |
vulnerable | 2026-06-08 07:47:12.777638 |
D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
Published: 2026-01-05T21:14:48.992Z
Updated: 2026-05-25T23:41:34.467Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9279 |
vulnerable | 2026-06-08 05:27:21.078891 |
Details available
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device.
Published: 2020-04-20T22:41:28.000Z
Updated: 2024-08-04T10:26:15.764Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9278 |
vulnerable | 2026-06-08 05:27:21.078476 |
Details available
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL.
Published: 2020-04-20T22:41:14.000Z
Updated: 2024-08-04T10:26:16.099Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9277 |
vulnerable | 2026-06-08 05:27:21.078138 |
Details available
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks (e.g., modify the admin password) with no authentication.
Published: 2020-04-20T22:40:32.000Z
Updated: 2024-08-04T10:26:16.368Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9276 |
vulnerable | 2026-06-08 05:27:21.077662 |
Details available
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The function do_cgi(), which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with CVE-2020-9277.
Published: 2020-04-20T22:40:08.000Z
Updated: 2024-08-04T10:26:16.039Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9275 |
vulnerable | 2026-06-08 05:27:21.076342 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.