Actively exploited · Published Mar 5, 2020 · Assigned by mitre

CVE-2019-20500

High 7.8 Exploited

In plain English

A high-severity OS command injection in DWL-2600AP Access Point from D-Link. Attackers are actively exploiting it in the wild (listed by CISA on June 29, 2023). The chance it is exploited in the next 30 days is estimated at 96.7% (higher than 99.9% of all known vulnerabilities). Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)96.7%top 0.1% of all CVEs

Exploited in the wildYesCISA KEV since Jun 29, 2023

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Federal agencies must remediate by Jul 20, 2023.

Official description

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113 x_refsource_MISC
https://www.exploit-db.com/exploits/46841 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-20500 government-resource