high7.8Known exploitedPublic exploit code
CVE-2019-20500
D-Link DWL-2600AP Access Point Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-06-29. Federal due date: 2023-07-20.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- D-Link DWL-2600AP - Multiple OS Command Injection2019-05-14 · webapps · hardware
Impact
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dlink | Dwl-2600ap Firmware | through 4.2.0.15 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113
- https://www.exploit-db.com/exploits/46841
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113
- https://www.exploit-db.com/exploits/46841
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-20500