CVE-2020-25506
D-Link DNS-320 Device Command Injection Vulnerability
Description
CVE-2020-25506 is a CRITICAL command injection vulnerability affecting D-Link DNS-320 network attached storage (NAS) devices, carrying a CVSS 3.1 score of 9.8. The vulnerability exists in the system_mgr.cgi component of the D-Link DNS-320 FW v2.06B01 Revision Ax, allowing remote attackers to execute arbitrary operating system commands without authentication. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.93863 (99.87th percentile), this vulnerability demonstrates near-maximum real-world exploitation activity and requires immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dns-320 firmware | 2.06b01 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675(Exploit, Third Party Advisory)
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183(Vendor Advisory)
- https://www.dlink.com/en/security-bulletin/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25506(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2020-25506 is classified under CWE-78 — Improper Neutralization of Special Elements used in an OS Command. OS command injection occurs when software constructs operating system commands using externally influenced input without properly neutralizing special elements (such as semicolons, pipes, backticks, or other shell metacharacters) that could modify the intended command. This allows attackers to inject arbitrary OS commands that execute with the privileges of the vulnerable application.
In the context of D-Link DNS-320 NAS devices, the command injection in system_mgr.cgi is exceptionally dangerous because NAS devices typically run as root, store critical data, and are often accessible from the local network or internet. When command injection is achieved on a NAS device, attackers gain full access to all stored files, can encrypt data for ransomware, exfiltrate sensitive documents, or use the device as a pivot point for lateral movement within the network.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2020-25506 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker complete access to all files stored on the NAS device, including shared documents, backups, personal files, media libraries, and any other data stored by users and connected systems. The attacker can also access NAS configuration data including user credentials and network settings.
Integrity (HIGH): Attackers can modify, delete, or encrypt any files stored on the NAS. They can also alter system configurations, install persistent backdoors, modify firmware, and plant malicious files that may be distributed to connected clients.
Availability (HIGH): Complete disruption of NAS services is possible, including encryption of all stored data (ransomware), deletion of critical files and backups, and rendering the device inoperable through firmware corruption.
Scope Unchanged: While the CVSS scope is Unchanged, the practical impact is amplified because NAS devices serve as centralized file storage and backup targets for multiple users and systems.
With an EPSS score of 0.93863 (99.87th percentile), this vulnerability ranks among the most likely to be exploited of any cataloged CVE.
Exploit Maturity
CVE-2020-25506 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability is actively exploited with public proof-of-concept exploit code available on GitHub. The EPSS score of 0.93863 (99.87th percentile) places it among the most exploited vulnerabilities tracked globally. The command injection is straightforward to exploit with no authentication required.
Ransomware association: No direct ransomware association has been confirmed per current KEV data. However, NAS devices are high-value ransomware targets because they contain centralized data stores. Multiple NAS-targeting ransomware families (such as Qlocker, DeadBolt, and eCh0raix) have historically targeted similar vulnerabilities in consumer NAS devices.
Attack surface: D-Link DNS-320 devices with web interfaces accessible from the network are directly vulnerable. Many consumer NAS devices are inadvertently exposed to the internet through port forwarding or UPnP configurations. IoT search engines regularly index these devices, facilitating automated mass exploitation.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. All organizations and consumers using affected devices should remediate immediately.
Remediation
- Apply firmware updates immediately if available. Check the D-Link support announcement (SAP10183) for patched firmware versions. Apply any available updates for the DNS-320 with highest priority.
- If no firmware update is available, replace the device. The D-Link DNS-320 is an older product that may have reached end-of-life. If D-Link no longer provides security updates, replace the device with a currently supported NAS product from a vendor that actively provides security patches.
- Disconnect the device from the internet immediately. As an emergency measure, ensure the NAS is not accessible from the internet. Remove any port forwarding rules, disable UPnP, and block external access to the device's management interface and services.
- Restrict network access to the NAS. Implement firewall rules to limit access to the DNS-320 to only trusted internal hosts. Disable unnecessary services and protocols on the device.
- Back up critical data to a separate location. Copy important files from the DNS-320 to a different, secure storage location. This ensures data preservation in case the device has been compromised or needs to be replaced.
- Scan for indicators of compromise. Review the NAS for unexpected files, modified configurations, unknown user accounts, or unusual network activity. Investigate any suspicious findings as potential indicators of prior exploitation.
Technical Details
CVE-2020-25506 is a CRITICAL-severity command injection vulnerability in D-Link DNS-320 NAS devices exploitable remotely over the network without authentication. The attack complexity is low, requiring no specialized conditions. No privileges or user interaction are needed.
Technical mechanism: The vulnerability exists in the system_mgr.cgi component of the DNS-320 web interface running firmware version 2.06B01 Revision Ax. The CGI script constructs operating system commands using user-supplied input parameters without properly sanitizing or escaping shell metacharacters. An attacker can inject arbitrary OS commands by including shell metacharacters (such as semicolons, backticks, or pipe characters) in HTTP request parameters sent to the system_mgr.cgi endpoint. The injected commands execute with the privileges of the web server process, which on the DNS-320 typically runs as root, granting full system access.
Affected products and versions: D-Link DNS-320 firmware version 2.06B01.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible, low-complexity attack requiring no privileges or user interaction, with maximum impact across all three security dimensions. The critical rating reflects the ease of exploitation and the severity of arbitrary command execution on a data storage device.
Frequently Asked Questions
Is CVE-2020-25506 being actively exploited?
Yes, CVE-2020-25506 is actively exploited in the wild. It is listed in CISA's KEV catalog and public exploit code is available. The EPSS score of 0.93863 (99.87th percentile) represents near-maximum exploitation probability. The unauthenticated command injection makes exploitation trivial for attackers.
What products are affected by CVE-2020-25506?
CVE-2020-25506 affects D-Link DNS-320 NAS devices running firmware version 2.06B01. Check your device's firmware version through the web administration interface. Consult the D-Link security announcement SAP10183 for patching information and the complete list of affected models.
How do I fix CVE-2020-25506?
Apply the latest firmware update from D-Link if available for the DNS-320. If the device has reached end-of-life, replace it with a currently supported NAS product. As an immediate measure, disconnect the device from the internet and restrict network access to trusted hosts only. Back up all critical data to a separate secure location.
How severe is CVE-2020-25506?
CVE-2020-25506 is rated CRITICAL with a CVSS 3.1 score of 9.8. It enables unauthenticated remote command execution on a network storage device, giving attackers full control over all stored data. The EPSS score of 0.93863 (99.87th percentile) and KEV listing confirm this is among the most exploited NAS vulnerabilities. Data stored on compromised devices should be considered at risk of theft, modification, or encryption.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.