Unauthenticated Remote DNS Change Vulnerability (DNSChanger): DSL‑2740R (fixed) and non‑European DSL routers
08 April, 2019
The following was originally posted by D-Link in Dec. 2016. This announcement has been updated for the latest information published on April 4, 2019 regarding DNSChanger Malware.
Tom’s Guide article published a report in Dec. 2016 discussing “a new malvertising campaign attacking at least 166 models from multiple manufacturers.”
There's evidence that the malware targets 166 distinct router models, but only a handful can be identified. In the original report D-Link DSL-2740R was identified and a patch were offered.
D-Link has been made aware of a new post by a 3rd party expanding the scope and additionally accusing D-Link DSL-2640B, D-Link DSL-2780B, and D-Link DSL-526B routers which are not sold in Europe with the accused firmware versions.
Accreditation and Coordination
Additional internet news posts from 2016 includes:
DSL-2640B / Hardware Rev. T1 / Firmware GE_1.07 / Non-US : Link
DSL-2740R / Hardware Rev. Ax / Firmware EU_1.15 / Non-US : Link
DSL-2780B / Hardware Rev. Ax / Firmware DLINK_1.01.14 / Non-US : Link
DSL-526B / Hardware Rev. Bx / Firmware AU_2.01 / Non-US : Link
Additional internet news posts from 2019 includes:
Affected Product Models and Patches:
DSL-2740R, which was available in Europe, was patched accordingly when it was identified to be vulnerable in 2015. The newly accused products are deployed with firmware that is not offered in Europe. In addition, some of these models are deployed directly from carriers with certified and unique configurations.
If you have received your device from your carrier please contact them directly for patches. It is recommended to contact your regional D-Link Customer Care for specific fixes. Using firmware that is not intended for your region or carrier is at your own risk and may disable the device.
|Model||Hardware Revision||Region||Affected FW||Fixed FW||Last Updated|
|DSL-526B||All Revision B||Australia||AU v2.01 and older (lower)||Under Investigation||
|DSL-2640B||All Revision T||Malaysia||GE v1.07 and older (lower)||Under Investigation||
|DSL-2740R||All Revision A||Europe||EU v1.15 and older (lower)||1.17||
|DSL-2780B||All Revision A||AU/NZ||v1.01.14 and older (lower)||Under Investigation||05/04/2019|
Options for D-Link Routers and Gateways that are no longer supported or are under investigation :
1. Contact your DSL Service Provider or Regional D-Link Customer Care for latest information and patches.
2. Factory-Reset the device through its web-configuration interface at http://192.168.0.1, set a new unique password, and complete setup for your DSL carrier.
3. Modify the device through its web-configuration interface at http://192.168.0.1, and manually set Domain Name Server (DNS) values (instructions can be found in the devices User Manuals Here):
- Google DNS : 220.127.116.11 or 18.104.22.168
- Cloudflare DNS: 22.214.171.124
Regarding Security patch for your D-Link Devices
Firmware updates address the security vulnerabilities of affected D-Link devices. D-Link will update this, when applicable, and we strongly recommend all users install the relevant updates.
As there are different hardware revisions of our products, please check your device before downloading the corresponding firmware update. The hardware revision information can usually be found on the product label on the underside of the product next to the serial number. Alternatively, it can also be found on the device web configuration.