PT-2019-4006 · D Link · Dir-835+9

Published 2019-09-20 · Updated 2025-04-03 · CVE-2019-16920

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-655C versions D-Link DIR-866L versions D-Link DIR-652 versions D-Link DHP-1565 versions D-Link DIR-855L versions D-Link DAP-1533 versions D-Link DIR-862L versions D-Link DIR-615 versions D-Link DIR-835 versions D-Link DIR-825 versions

Description Unauthenticated remote code execution occurs in D-Link products. The issue occurs when an attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to command injection. An attacker who successfully triggers the command injection could achieve full system compromise. This is done by sending a specially crafted HTTP POST request through PingTest.

Recommendations For D-Link DIR-655C, consider disabling the PingTest interface until a patch is available. For D-Link DIR-866L, restrict access to the PingTest handler to minimize the risk of exploitation. For D-Link DIR-652, avoid using the PingTest command until the issue is resolved. For D-Link DHP-1565, consider disabling the PingTest function until a patch is available. For D-Link DIR-855L, restrict access to the PingTest interface to minimize the risk of exploitation. For D-Link DAP-1533, avoid using the PingTest command until the issue is resolved. For D-Link DIR-862L, consider disabling the PingTest handler until a patch is available. For D-Link DIR-615, restrict access to the PingTest interface to minimize the risk of exploitation. For D-Link DIR-835, avoid using the PingTest command until the issue is resolved. For D-Link DIR-825, consider disabling the PingTest function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-04537

CVE-2019-16920

Affected Products

Dap-1533

Dhp-1565

Dir-615

Dir-652

Dir-655

Dir-825

Dir-835

Dir-855L

Dir-862L

Dir-866L

References · 16

• 🔥 https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3 · Exploit
• 🔥 https://seebug.org/vuldb/ssvid-98079 · Exploit
• 🔥❌ https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r · Exploit, Deleted
• https://bdu.fstec.ru/vul/2019-04537 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16920 · Security Note
• https://kb.cert.org/vuls/id/766427 · Note
• https://t.me/true_secator/3042 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920 · Note
• https://securitylab.ru/news/501603.php · Note
• https://t.me/cvenotify/117656 · Telegram Post
• https://t.me/opennews/5821 · Telegram Post
• https://threatpost.com/d-link-home-routers-unpatched/148941 · Note
• https://t.me/cibsecurity/7252 · Telegram Post
• https://t.me/cvenotify/109982 · Telegram Post