CVE-2019-16920
D-Link Multiple Routers Command Injection Vulnerability
Description
CVE-2019-16920 is an unauthenticated command injection vulnerability affecting multiple D-Link router models. The flaw exists in the ping_test functionality accessible via the web management interface, allowing a remote attacker to execute arbitrary operating system commands without authentication. This vulnerability is particularly dangerous because it requires no credentials and can be exploited by any attacker with network access to the router's management interface. It was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022, and with an EPSS score of 97.4% (99.9th percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-655 firmware | <= 3.02b05 |
| dlink | dir-866l firmware | <= 1.03b04 |
| dlink | dir-652 firmware | - |
| dlink | dhp-1565 firmware | <= 1.01 |
| dlink | dir-855l firmware | - |
| dlink | dap-1533 firmware | - |
| dlink | dir-862l firmware | - |
| dlink | dir-615 firmware | - |
| dlink | dir-835 firmware | - |
| dlink | dir-825 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/zeroday/FG-VD-19-117(Broken Link, Third Party Advisory)
- https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3(Exploit, Third Party Advisory)
- https://www.kb.cert.org/vuls/id/766427(Third Party Advisory, US Government Resource)
- https://www.seebug.org/vuldb/ssvid-98079(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CVE-2019-16920 is classified under CWE-78, which describes vulnerabilities where user input is incorporated into operating system commands without proper sanitization. The D-Link router's ping_test function fails to validate or sanitize the input parameters, allowing attackers to inject shell commands that are executed with root privileges on the router.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2019-16920 allows unauthenticated remote attackers to execute arbitrary commands with root privileges on affected D-Link routers. This grants complete control over the device, enabling attackers to intercept and modify all network traffic passing through the router, change DNS settings to redirect users to malicious sites, install persistent backdoors in the router firmware, use the compromised router as a pivot point for attacks on the internal network, and recruit the device into a botnet for DDoS attacks or cryptomining. The unauthenticated nature of the vulnerability combined with the network-accessible attack vector and root-level command execution makes this one of the most severe router vulnerabilities. Consumer and small business routers are particularly at risk as they are frequently internet-facing with management interfaces exposed.
Exploit Maturity
CVE-2019-16920 has been confirmed as actively exploited in the wild by CISA. The exploitation technique is straightforward — sending a crafted HTTP request to the ping_test endpoint with injected commands — and requires no authentication or specialized tools. With an EPSS score of 97.4% (99.9th percentile), exploitation is near-certain for any exposed affected D-Link router. IoT botnets such as Mirai variants are known to actively scan for and exploit vulnerable D-Link devices.
Remediation
- Update router firmware: Check for and install the latest firmware update from D-Link that addresses CVE-2019-16920. If the router model is end-of-life and no patch is available, replace the device.
- Disable remote management: Disable the web management interface on the WAN side to prevent exploitation from the internet.
- Restrict management access: If management access is required, restrict it to specific trusted IP addresses using access control lists.
- Replace end-of-life devices: If the affected D-Link router model is no longer supported with security updates, replace it with a currently supported device.
- Monitor network traffic: Deploy network monitoring to detect unusual traffic patterns from the router, such as unexpected outbound connections or DNS resolution changes.
Technical Details
CVE-2019-16920 is an unauthenticated OS command injection vulnerability in the web management interface of multiple D-Link router models. The vulnerability exists in the ping_test functionality, which allows users to test network connectivity by pinging a specified IP address. The router's web server does not require authentication for this function and fails to sanitize the target address parameter before passing it to an OS-level ping command. An attacker can inject additional shell commands using standard command injection techniques such as semicolons, pipes, or backticks appended to the IP address parameter. The injected commands execute with root privileges on the router's embedded Linux operating system, granting full control over the device.
Frequently Asked Questions
Is CVE-2019-16920 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2019-16920. IoT botnets actively scan for vulnerable D-Link routers, and the EPSS score of 97.4% confirms near-certain exploitation for exposed devices.
What products are affected by CVE-2019-16920?
CVE-2019-16920 affects multiple D-Link router models including the DIR-655, DIR-866L, DIR-652, and DHP-1565. Check D-Link's security advisory for a complete list of affected models and firmware versions.
How do I fix CVE-2019-16920?
Update to the latest firmware from D-Link. If your router model is end-of-life with no available patch, replace it with a currently supported device. Disable remote management access from the WAN interface as an immediate mitigation.
How severe is CVE-2019-16920?
CVE-2019-16920 is a critical vulnerability that allows unauthenticated remote command execution with root privileges on affected routers. It requires no credentials, has public exploits available, and is actively targeted by IoT botnets.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.