CVE-2019-16920: D-Link Multiple Routers Command Injection Vulnerability
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Other sources
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Disconnect affected end-of-life D-Link routers from networks immediately if still in use: unplug Ethernet cables, disable Wi‑Fi, and isolate the devices from management and production networks. Affected models named in the advisory include DIR-655C, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. Decommission or replace these devices rather than leaving them connected.
Event History
Frequently Asked Questions
What is CVE-2019-16920?
CVE-2019-16920 is a command injection vulnerability that allows for unauthenticated remote code execution in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565.
How severe is CVE-2019-16920?
CVE-2019-16920 has a severity rating of 9.8 out of 10, making it a critical vulnerability.
Which D-Link routers are affected by CVE-2019-16920?
D-Link routers like DIR-655C, DIR-866L, DIR-652, and DHP-1565 are affected by CVE-2019-16920.
How can an attacker exploit CVE-2019-16920?
An attacker can exploit CVE-2019-16920 by sending an arbitrary input to the 'PingTest' device common gateway interface, leading to command injection and potential remote code execution.
Are there any known fixes for CVE-2019-16920?
At the moment, there are no known fixes or patches available for CVE-2019-16920. It is recommended to update to the latest firmware or contact the vendor for further assistance.