Live › vulnerability › CVE-2019-16920
Go to dashboardSeveral D-Link router models contain a command injection flaw that lets an attacker run operating system commands on the device. The attack gives full control of the router, and CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted product is end-of-life and should be disconnected if still in use.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| D-Link Multiple Routers | vendor | – | – |
Identify D-Link router models on the network and compare them to the affected models listed in the CVE record (unknown from sources) Check whether the device is still supported by D-Link; the CISA entry says the product is end-of-life
Disconnect the affected end-of-life D-Link router from the network if it is still in use, as CISA requires Replace it with a supported device; no patched firmware is named in the sources
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
This page as .md · .json · in your agent: get_signal("CVE-2019-16920")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.