{"id":"CVE-2019-16920","kind":"vulnerability","aliases":["CVE-2019-16920"],"related":[],"title":"D-Link Multiple Routers: D-Link Multiple Routers Command Injection Vulnerability","description":"Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a \"PingTest\" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.","summary":"Several D-Link router models contain a command injection flaw that lets an attacker run operating system commands on the device. The attack gives full control of the router, and CISA lists it as actively exploited.","severity":"critical","cvss":10.0,"epss":0.99996,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"D-Link Multiple Routers","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","exploited","infrastructure","routers","self-hosted"],"not_affected_if":["device-already-removed","no-d-link-router"],"how_to_check":"Identify D-Link router models on the network and compare them to the affected models listed in the CVE record (unknown from sources)\nCheck whether the device is still supported by D-Link; the CISA entry says the product is end-of-life","fix":"Disconnect the affected end-of-life D-Link router from the network if it is still in use, as CISA requires\nReplace it with a supported device; no patched firmware is named in the sources","status":"open","published_at":"2019-09-27T12:15:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:15+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:20:15Z","model":"claude-haiku-5-5","output":{"fix":"Disconnect the affected end-of-life D-Link router from the network if it is still in use, as CISA requires\nReplace it with a supported device; no patched firmware is named in the sources","reach":"unknown","impact":"high","summary":"Several D-Link router models contain a command injection flaw that lets an attacker run operating system commands on the device. The attack gives full control of the router, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["d-link","self-hosted","routers"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands as root on the router","analyst_note":"Find the affected D-Link model list and the reachable attack vector (WAN or LAN) in the NVD or vendor advisory, and confirm whether any firmware fix exists.","how_to_check":"Identify D-Link router models on the network and compare them to the affected models listed in the CVE record (unknown from sources)\nCheck whether the device is still supported by D-Link; the CISA entry says the product is end-of-life\nunknown","needs_analyst":true,"not_affected_if":["no-d-link-router","device-already-removed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000503,"input_tokens":2832,"output_tokens":439,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1533':144C '-1565':93C '-16920':16A,19A '-2019':15A,18A '-615':149C '-652':90C '-825':154C '-835':151C '655c':85C '855l':142C '862l':147C '866l':88C 'achiev':126C 'activ':69B 'affect':139C 'also':138C 'arbitrari':102C 'attack':48B,57B,99C,118C 'cisa':65B 'code':73C 'command':11A,42B,52B,123C 'common':108C,115C 'compromis':129C 'contain':40B 'control':60B 'could':112C,125C 'cve':14A,17A 'd':2A,7A,21A,26B,36B,78C 'd-link':1A,6A,20A,25B,35B,77C 'dap':143C 'devic':55B,107C 'dhp':92C 'dir':84C,87C,89C,141C,146C,148C,150C,153C 'dir-655c':83C 'dir-855l':140C 'dir-862l':145C 'dir-866l':86C 'execut':74C 'exploit':28B,70B 'flaw':44B 'found':134C 'full':59B,127C 'gateway':109C 'give':58B 'host':33B 'independ':133C 'infrastructur':29B 'inject':12A,43B,116C,124C 'input':103C 'interfac':110C 'issu':95C 'later':130C 'lead':113C 'let':46B 'link':3A,8A,22A,27B,37B,79C 'list':66B 'model':39B 'multipl':4A,9A 'multiple':23A 'occur':75C,96C 'oper':50B 'pingtest':106C 'product':80C 'remot':72C 'router':5A,10A,30B,38B,63B 'routers':24A 'run':49B 'self':32B 'self-host':31B 'send':100C 'sever':34B 'success':120C 'system':51B,128C 'trigger':121C 'unauthent':71C 'vulner':13A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-09-27T12:15:10+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-16920","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16920","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:24+00:00","note":null},{"source":"epss","external_id":"CVE-2019-16920","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16920","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-16920","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16920","severity":null,"published_at":"2019-09-27T12:15:10+00:00","modified_at":"2026-06-17T02:22:57+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}