CVE-2019-16920
En bref
- Source
- NVD
- EPSS
- EPSS 100.00 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Analyzed
Description
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Faiblesses (CWE)
- CWE-78 — Injection de commande système
Références
- https://fortiguard.com/zeroday/FG-VD-19-117
- https://www.seebug.org/vuldb/ssvid-98079
- https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3
- https://www.kb.cert.org/vuls/id/766427
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-7414
- GCVE · GCVE-0-2019-16920
Configurations affectées (CPE NVD)
cpe:2.3:o:dlink:dir-655_firmware:*:*:*:*:*:*:*:*≤ 3.02b05cpe:2.3:o:dlink:dir-866l_firmware:*:*:*:*:*:*:*:*≤ 1.03b04cpe:2.3:o:dlink:dir-652_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dhp-1565_firmware:*:*:*:*:*:*:*:*≤ 1.01cpe:2.3:o:dlink:dir-855l_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dap-1533_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-862l_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-615_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-835_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dlink:dir-825_firmware:-:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |