cyfenced.com →

[ CVE-2016-20017 · Published 19 Oct 2022 ]

D-Link DSL-2750B Devices Command Injection Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 67%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-01-08
  • EPSS: 67% chance of exploitation in the next 30 days (higher than 99% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

CISA: D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 29 Jan 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References