CVE-2019-16920
At a glance
- Source
- NVD
- EPSS
- EPSS 100.00 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Analyzed
Description
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
References
- https://fortiguard.com/zeroday/FG-VD-19-117
- https://www.seebug.org/vuldb/ssvid-98079
- https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3
- https://www.kb.cert.org/vuls/id/766427
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-7414
- GCVE · GCVE-0-2019-16920
Affected configurations (NVD CPE)
cpe:2.3:o:dlink:dir-655_firmware:*:*:*:*:*:*:*:*≤ 3.02b05cpe:2.3:o:dlink:dir-866l_firmware:*:*:*:*:*:*:*:*≤ 1.03b04cpe:2.3:o:dlink:dir-652_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dhp-1565_firmware:*:*:*:*:*:*:*:*≤ 1.01cpe:2.3:o:dlink:dir-855l_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dap-1533_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-862l_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-615_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-835_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-825_firmware:-:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |