CVE-2019-16920
D-Link Multiple Routers: Command Injection
As of , CVE-2019-16920 in D-Link Multiple Routers is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 25 March 2022
- US federal deadline
- 15 April 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.70 on 25 March 2022EPSS on the day CISA listed it.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- No vendor link in CISA's entry
What CISA says to do
The impacted product is end-of-life and should be disconnected if still in use.
CISA's required action
What the flaw is
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
CISA's description
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
The CVE record's description, from mitre
- CVE published
- 27 September 2019
- Assigned by
- mitre
- CVSS
- 9.8 Critical (CVSS 3.1, from CISA-ADP)
- CWE-78
- Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Multiple Routers: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2018-6530OS Command Injection | D-Link Multiple Routers | Patch this weekRansomware use; EPSS 0.97 | 0.97 | ||
| CVE-2021-45382Remote Code Execution | D-Link Multiple Routers | Patch this weekEPSS 0.98 | 0.98 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org