CVE-2016-20017
D-Link DSL-2750B Devices Command Injection Vulnerability
Description
CVE-2016-20017 is a CRITICAL command injection vulnerability in D-Link DSL-2750B devices running firmware versions prior to 1.05, assigned a CVSS 3.1 score of 9.8. The flaw, classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), allows remote unauthenticated attackers to inject and execute arbitrary operating system commands via the cli parameter of the login.cgi endpoint — without requiring any credentials or user interaction. This vulnerability was actively exploited in the wild from 2016 through at least 2022 and is included in CISA’s Known Exploited Vulnerabilities catalog with a remediation deadline of January 29, 2024. D-Link DSL-2750B devices are consumer and small-business DSL routers, and many remain deployed without firmware updates.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dsl-2750b firmware | < 1.05 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://seclists.org/fulldisclosure/2016/Feb/53(Exploit, Mailing List, Third Party Advisory)
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/44760(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-20017(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command
CVE-2016-20017 is rooted in CWE-77 — Improper Neutralization of Special Elements used in a Command. The D-Link DSL-2750B login page accepts a cli parameter that is passed directly to a system shell command without proper sanitization or escaping of special characters. An attacker can inject shell metacharacters or command separators into this parameter, causing the device to execute attacker-controlled commands with the privileges of the web server process — typically root on embedded devices.
Command injection vulnerabilities in consumer networking equipment are especially long-lasting threats because firmware update adoption rates are historically very low for these device categories. End users often lack the technical knowledge or motivation to update router firmware, and manufacturers may stop providing updates for older models, leaving devices permanently vulnerable. This makes command injection in routers and DSL modems a persistent and recurring attack surface for botnet operators and other threat actors.
Impact Analysis
CVE-2016-20017 receives the maximum CRITICAL severity rating with a CVSS 3.1 score of 9.8, reflecting complete compromise potential across all three impact dimensions.
Confidentiality (High): Remote command execution on the DSL-2750B grants full access to all data stored on or accessible by the device. This includes Wi-Fi credentials, PPPoE authentication credentials (broadband username and password), DHCP leases, UPnP configurations, and any data transiting the router. Credential theft can enable further ISP account compromise.
Integrity (High): An attacker with command execution capabilities can modify firmware, alter routing tables, change DNS servers to perform DNS hijacking attacks on all connected devices, add persistent backdoors, or enroll the device into a botnet. DNS hijacking attacks can redirect all traffic from devices on the local network to attacker-controlled servers.
Availability (High): Attackers can crash the device, cause a denial of service, or permanently brick the hardware. Botnet operators who compromise these devices routinely use them to conduct DDoS attacks, exhausting available bandwidth and causing connectivity disruption.
With an EPSS score of 0.934 (99.81st percentile), exploitation remains a near-certainty for any internet-exposed device running vulnerable firmware.
Exploit Maturity
CVE-2016-20017 has extremely high exploit maturity, having been actively exploited in the wild for over six years since initial discovery.
Long-running active exploitation: The NVD description explicitly notes exploitation in the wild from 2016 through 2022. This multi-year exploitation window reflects the persistent nature of unpatched consumer router vulnerabilities and the continued deployment of vulnerable D-Link DSL-2750B devices.
Public exploit code: Exploit code for CVE-2016-20017 has been publicly available in multiple repositories including Exploit-DB and security mailing lists since 2016. The attack is simple to execute and requires only an HTTP request to the vulnerable login.cgi endpoint with a malicious cli parameter.
Botnet recruitment: Vulnerable D-Link DSL-2750B devices have been targeted by botnet operators for recruitment into DDoS botnets. The combination of internet exposure, command injection, and no authentication requirement makes these devices ideal botnet targets.
CISA KEV listing: Despite the original disclosure date of 2016, CISA listed this CVE in the Known Exploited Vulnerabilities catalog with a January 2024 remediation deadline, confirming ongoing exploitation activity against still-deployed vulnerable devices.
Remediation
- Update firmware to version 1.05 or later. D-Link released firmware version 1.05 for the DSL-2750B that addresses this vulnerability. Check the D-Link support announcement for the appropriate firmware update for your hardware revision.
- Replace end-of-life devices. D-Link DSL-2750B devices that have reached end-of-life and no longer receive security updates should be replaced with supported networking equipment. Running unsupported devices on internet-facing connections is a persistent security risk.
- Disable remote management. Ensure that the DSL-2750B web management interface is not accessible from the internet (WAN side). If remote management is not required, disable it in the router administration panel to limit exposure.
- Isolate or segment the device. If the device cannot be replaced or patched, place it behind an additional security layer or restrict its management interface to trusted IP addresses only.
- Monitor for signs of compromise. Check for unexpected device behavior such as altered DNS settings, unusual outbound traffic, or unknown connected clients that may indicate the device has been compromised and enrolled in a botnet.
- Per CISA KEV guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Technical Details
CVE-2016-20017 affects D-Link DSL-2750B devices running firmware versions prior to 1.05. The DSL-2750B is a consumer-grade ADSL2+ router commonly deployed by ISPs and home users.
Vulnerability location: The vulnerability exists in the login.cgi CGI script accessible at the router’s web management interface. The script accepts a cli parameter in HTTP requests. This parameter is intended to support command-line interface functionality through the web interface but fails to sanitize or restrict the content of the parameter before using it in a shell command execution context.
Command injection mechanism: By supplying shell metacharacters or command separators (such as semicolons, pipes, or backticks) in the cli parameter, an attacker can break out of the intended command context and inject arbitrary additional commands. Because embedded router firmware typically runs web server processes as root, injected commands execute with full system privileges.
Unauthenticated access: The login.cgi endpoint is the pre-authentication login page of the device, meaning exploitation occurs before any credentials are required. This allows any attacker with network access to the management interface to immediately exploit the vulnerability.
Attack vector: With Network attack vector, Low complexity, no privileges required, and no user interaction (AV:N/AC:L/PR:N/UI:N), the vulnerability is trivially exploitable by any attacker who can reach the device’s web management port — which on many deployed devices is accessible directly from the internet.
Frequently Asked Questions
What is CVE-2016-20017?
CVE-2016-20017 is a critical command injection vulnerability (CWE-77) in D-Link DSL-2750B routers running firmware before version 1.05. It allows remote unauthenticated attackers to execute arbitrary OS commands via the cli parameter in the login.cgi endpoint. The vulnerability was exploited in the wild from 2016 through at least 2022 and is listed in CISA’s Known Exploited Vulnerabilities catalog.
Which products are affected by CVE-2016-20017?
D-Link DSL-2750B devices running firmware versions prior to 1.05 are affected. These are consumer and small-business ADSL2+ routers. Organizations and individuals using this device model should verify their firmware version and apply the available update. Devices that have reached end-of-life without available updates should be replaced.
How do I fix CVE-2016-20017?
Update the DSL-2750B firmware to version 1.05 or later using the firmware available from D-Link’s support site. Disable remote management access from the internet if not required, and consider replacing end-of-life devices that cannot receive security updates. Per CISA KEV guidance, discontinue use of the product if mitigations are unavailable.
How severe is CVE-2016-20017?
CVE-2016-20017 is rated CRITICAL with a CVSS 3.1 score of 9.8. Its EPSS score of 0.934 places it at the 99.81st percentile for exploitation likelihood. Despite being originally disclosed in 2016, it continues to be actively exploited. CISA confirmed ongoing exploitation and set a federal remediation deadline of January 29, 2024, reflecting that vulnerable devices remain widely deployed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.