CVE-2019-16920criticalunder attackCWE-78

CVE-2019-16920

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon19 days
Published on NVDSep 27
1st PoC+19d
CISA KEV+910d
Action required by CISAfederal deadline: 2022-04-15

The impacted product is end-of-life and should be disconnected if still in use.

In short

D-Link routers have a critical flaw where attackers can send specially crafted commands to a network diagnostic tool without needing a password, allowing them to take complete control of the device.

Technical detail

Unauthenticated command injection vulnerability in the PingTest CGI endpoint allows remote attackers to execute arbitrary OS commands via malicious input, leading to full system compromise. The vulnerability requires network access to the affected device but no authentication credentials. Exploitation results in complete device takeover with root privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.