Actively exploited · Published Sep 27, 2019 · Assigned by mitre
CVE-2019-16920
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in Multiple Routers from D-Link. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Apr 15, 2022.
Official description
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/zeroday/FG-VD-19-117 x_refsource_MISC
- https://www.seebug.org/vuldb/ssvid-98079 x_refsource_MISC
- https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3 x_refsource_MISC
- VU#766427 third-party-advisory, x_refsource_CERT-VN
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920 government-resource