CVE-2019-20500: D-Link DWL-2600AP Access Point Command Injection Vulnerability
First published: Thu Mar 05 2020(Updated: )
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dlink Dwl-2600ap Firmware | <=4.2.0.15 | |
| Dlink Dwl-2600ap | ||
| D-Link DWL-2600AP access point | ||
| All of | ||
| Dlink Dwl-2600ap Firmware | <=4.2.0.15 | |
| Dlink Dwl-2600ap |
Remedy
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-20500.
What is the title of the vulnerability?
The title of the vulnerability is D-Link DWL-2600AP Access Point Command Injection Vulnerability.
What is the description of the vulnerability?
The D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Which software is affected by this vulnerability?
The D-Link DWL-2600AP access point is affected by this vulnerability.
Are there any references available for this vulnerability?
Yes, you can find more information about this vulnerability in the D-Link support announcement at https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113
- collector/nvd-index
- agent/type
- agent/remedy
- agent/weakness
- agent/softwarecombine
- agent/description
- agent/severity
- agent/title
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/event
- agent/tags
- collector/nvd-cve
- source/NVD
- vendor/dlink
- canonical/dlink dwl-2600ap firmware
- version/dlink dwl-2600ap firmware/4.2.0.15
- canonical/dlink dwl-2600ap
- vendor/d-link
- canonical/d-link dwl-2600ap access point