CVE-2020-25506criticalunder attackCWE-78

CVE-2020-25506

Published · Updated

Follow this CVE+ Monitor DNS-320 Device

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon
Published on NVDFeb 2
CISA KEV+274d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

D-Link DNS-320 routers with firmware version 2.06B01 have a security flaw that allows attackers to run arbitrary commands on the device remotely without authentication, potentially taking complete control of the router.

Technical detail

Command injection vulnerability in system_mgr.cgi endpoint allows unauthenticated remote attackers to execute arbitrary OS commands via specially crafted input, leading to complete system compromise. The vulnerability exists in the command processing logic that fails to properly sanitize user input before passing it to shell execution functions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a