Actively exploited · Published Sep 16, 2019 · Assigned by mitre
CVE-2019-16057
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity OS command injection in DNS-320 Storage Device from D-Link. Attackers are actively exploiting it in the wild (listed by CISA on April 15, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 86.5% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by May 6, 2022.
Official description
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H