---
id: "CVE-2019-16920"
kind: "vulnerability"
aliases: ["CVE-2019-16920"]
title: "D-Link Multiple Routers: D-Link Multiple Routers Command Injection Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99996
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "D-Link Multiple Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["d-link", "exploited", "infrastructure", "routers", "self-hosted"]
not_affected_if: ["device-already-removed", "no-d-link-router"]
published_at: "2019-09-27T12:15:10+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16920", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-16920", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16920", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# D-Link Multiple Routers: D-Link Multiple Routers Command Injection Vulnerability

Several D-Link router models contain a command injection flaw that lets an attacker run operating system commands on the device. The attack gives full control of the router, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:D-Link Multiple Routers affected ? fixed ?

## How to check

Identify D-Link router models on the network and compare them to the affected models listed in the CVE record (unknown from sources)
Check whether the device is still supported by D-Link; the CISA entry says the product is end-of-life

## Fix

Disconnect the affected end-of-life D-Link router from the network if it is still in use, as CISA requires
Replace it with a supported device; no patched firmware is named in the sources

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-16920
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-16920
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-16920

## From the sources

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_