[ CVE-2019-16057 · Published 16 Sep 2019 ]
D-Link DNS-320 Remote Code Execution Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 86%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-04-15
- Known to be used in ransomware campaigns
- EPSS: 86% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
CISA: The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 6 May 2022): The impacted product is end-of-life and should be disconnected if still in use.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- blog.cystack.net/d-link-dns-320-rceExploitThird Party Advisory
- www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfThird Party AdvisoryUS Government Resource
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource