Live › vulnerability › CVE-2019-20500
Go to dashboardD-Link DWL-2600AP wireless access points have a command injection flaw in the web interface's Save Configuration function. An attacker who is logged in can inject shell commands through the configBackup or downloadServerip parameter and run them on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| D-Link DWL-2600AP Access Point | vendor | – | – |
| dlink dwl-2600ap firmware | vendor | <= 4.2.0.15 | – |
Identify DWL-2600AP devices on the network and check their firmware version against the vendor advisory; the sources do not give a version check command.
Apply the vendor update per D-Link instructions, or remove the device from service if no update is available (CISA directive).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2019-20500")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.