10

CVE-2019-16920

Warning
Exploit

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.

Data is provided by the National Vulnerability Database (NVD)
Dlink ≫ Dir-655 Firmware Version <= 3.02b05
   Dlink ≫ Dir-655 Versioncx
Dlink ≫ Dir-866l Firmware Version <= 1.03b04
   Dlink ≫ Dir-866l Versionax
Dlink ≫ Dir-652 Firmware Version-
   Dlink ≫ Dir-652 Versionax
Dlink ≫ Dhp-1565 Firmware Version <= 1.01
   Dlink ≫ Dhp-1565 Versionax
Dlink ≫ Dir-855l Firmware Version-
   Dlink ≫ Dir-855l Version-
Dlink ≫ Dap-1533 Firmware Version-
   Dlink ≫ Dap-1533 Version-
Dlink ≫ Dir-862l Firmware Version-
   Dlink ≫ Dir-862l Version-
Dlink ≫ Dir-615 Firmware Version-
   Dlink ≫ Dir-615 Version-
Dlink ≫ Dir-835 Firmware Version-
   Dlink ≫ Dir-835 Version-
Dlink ≫ Dir-825 Firmware Version-
   Dlink ≫ Dir-825 Version-

25.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

D-Link Multiple Routers Command Injection Vulnerability

Vulnerability

Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.

Description

The impacted product is end-of-life and should be disconnected if still in use.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 94.34% 0.999
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://fortiguard.com/zeroday/FG-VD-19-117
Third Party Advisory
Broken Link
https://www.kb.cert.org/vuls/id/766427
Third Party Advisory
US Government Resource
https://www.seebug.org/vuldb/ssvid-98079
Third Party Advisory
Exploit