Actively exploited · Published Feb 2, 2021 · Assigned by mitre

CVE-2020-25506

Critical 9.8 Exploited

In plain English

A critical-severity OS command injection in DNS-320 Device from D-Link. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)100.0%top 0.0% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling1Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.dlink.com/en/security-bulletin/ x_refsource_MISC
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183 x_refsource_MISC
https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25506 government-resource