AEGLIX vulnerability intelligence
CVE-2019-16920
CRITICAL · CVSS 9.8 · Analyzed
Published: 2019-09-27 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Severity and scoring
- CVSS score
- 9.8 · CRITICAL
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- D-Link · Multiple Routers
- Added to catalog
- 2022-03-25
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA remediation due date
- 2022-04-15
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:o:dlink:dir-655_firmware:*:*:*:*:*:*:*:*
Through (inclusive): 3.02b05
cpe:2.3:o:dlink:dir-866l_firmware:*:*:*:*:*:*:*:*
Through (inclusive): 1.03b04
cpe:2.3:o:dlink:dir-652_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dhp-1565_firmware:*:*:*:*:*:*:*:*
Through (inclusive): 1.01
cpe:2.3:o:dlink:dir-855l_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dap-1533_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-862l_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-615_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-835_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-825_firmware:-:*:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- https://fortiguard.com/zeroday/FG-VD-19-117
Broken Link · Third Party Advisory
- https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3
Exploit · Third Party Advisory
- https://www.kb.cert.org/vuls/id/766427
Third Party Advisory · US Government Resource
- https://www.seebug.org/vuldb/ssvid-98079
Exploit · Third Party Advisory
- https://fortiguard.com/zeroday/FG-VD-19-117
Broken Link · Third Party Advisory
- https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3
Exploit · Third Party Advisory
- https://www.kb.cert.org/vuls/id/766427
Third Party Advisory · US Government Resource
- https://www.seebug.org/vuldb/ssvid-98079
Exploit · Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920
US Government Resource