CVE-2019-20500

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 96,7%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada dlink dwl-2600ap firmware. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 29 Juni 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

Rincian

Terbit di NVD

5 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

96,7% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

D-Link DWL-2600AP Access Point Command Injection Vulnerability

Masuk KEV

29 Juni 2023

Tenggat CISA

20 Juli 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113 patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-20500 pemerintah AS
• https://www.exploit-db.com/exploits/46841 exploit · advisory pihak ketiga · vdb entry