#VU21624 OS Command Injection in D-Link products - CVE-2019-16920


| Updated: 2022-03-25

Vulnerability identifier: #VU21624

Vulnerability risk: High

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2019-16920

CWE-ID: CWE-78

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
DHP-1565
Hardware solutions / Routers & switches, VoIP, GSM, etc
DIR-652
Hardware solutions / Routers & switches, VoIP, GSM, etc
DIR-866L
Hardware solutions / Routers & switches, VoIP, GSM, etc
DIR-655
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: D-Link

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper authentication check in multiple D-Link products. A remote unauthenticated attacker can send an arbitrary input to a "PingTest" device common gateway interface and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

DHP-1565: 1.01

DIR-652: All versions

DIR-866L: 1.03b04

DIR-655: 3.02b05

External links
https://www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce.html
https://fortiguard.com/zeroday/FG-VD-19-117
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10124

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.


Latest bulletins with this vulnerability


Remote code execution in D-Link products