{"id":"CVE-2019-20500","kind":"vulnerability","aliases":["CVE-2019-20500"],"related":[],"title":"dlink dwl-2600ap firmware: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save…","description":"D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.\n\nCISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","summary":"D-Link DWL-2600AP wireless access points have a command injection flaw in the web interface's Save Configuration function. An attacker who is logged in can inject shell commands through the configBackup or downloadServerip parameter and run them on the device.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-06-29T00:00:00+00:00","products":[{"name":"D-Link DWL-2600AP Access Point","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dwl-2600ap firmware","fixed":[],"affected":"<= 4.2.0.15","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","dwl-2600ap","exploited","infrastructure","wireless-access-point"],"not_affected_if":["no-dwl-2600ap-devices","web-interface-restricted-to-trusted-admins"],"how_to_check":"Identify DWL-2600AP devices on the network and check their firmware version against the vendor advisory; the sources do not give a version check command.","fix":"Apply the vendor update per D-Link instructions, or remove the device from service if no update is available (CISA directive).","status":"open","published_at":"2020-03-05T15:15:11+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:27+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:06:27Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per D-Link instructions, or remove the device from service if no update is available (CISA directive).\nunknown","reach":"network","impact":"high","summary":"D-Link DWL-2600AP wireless access points have a command injection flaw in the web interface's Save Configuration function. An attacker who is logged in can inject shell commands through the configBackup or downloadServerip parameter and run them on the device.","category":"infrastructure","who_cares":["d-link","dwl-2600ap","wireless-access-point"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs arbitrary shell commands on the access point as an authenticated admin.","analyst_note":"Find the vendor firmware fix version and a way to check the installed firmware, since the sources give neither; check the CISA KEV entry for the due date.","how_to_check":"Identify DWL-2600AP devices on the network and check their firmware version against the vendor advisory; the sources do not give a version check command.\nunknown","needs_analyst":true,"not_affected_if":["no-dwl-2600ap-devices","web-interface-restricted-to-trusted-admins"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000503,"input_tokens":2860,"output_tokens":434,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':27A,30A '-20500':28A,31A '2600ap':4A,11A,37A,43A,50B,62B,106C '4.2.0.15':12A 'access':38A,55B,64B,107C 'action':130C,139C 'admin.cgi':129C 'appli':140C 'attack':80B 'authent':18A,111C 'cisa':137C 'command':20A,68B,88B,112C 'config':131C 'configbackup':91B,133C 'configur':77B,118C 'contain':109C 'cve':26A,29A 'd':7A,33A,46B,58B,102C 'd-link':6A,32A,45B,57B,101C 'devic':15A,100B 'discontinu':146C 'dlink':1A,40A 'downloadserverip':93B,135C 'dwl':3A,10A,36A,42A,49B,61B,105C 'dwl-2600ap':2A,9A,35A,41A,48B,60B,104C 'exploit':51B 'firmwar':5A 'firmware':44A 'flaw':70B 'function':78B,119C 'infrastructur':52B 'inject':21A,69B,86B,113C 'instruct':144C 'interfac':74B,123C 'link':8A,34A,47B,59B,103C 'log':83B 'metacharact':126C 'os':19A 'paramet':94B,136C 'per':142C 'point':39A,56B,65B,108C 'product':150C 'requir':138C 'rev':13A 'run':96B 'save':25A,76B,117C,132C 'shell':87B,125C 'unavail':154C 'updat':141C,152C 'use':124C,147C 'vendor':143C 'via':23A,115C 'vulner':22A,114C 'web':73B,122C 'wireless':54B,63B 'wireless-access-point':53B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-03-05T15:15:11+00:00","kev":{"dateAdded":"2023-06-29","dueDate":"2023-07-20","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-20500","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-20500","severity":null,"published_at":"2023-06-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-20500","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20500","severity":null,"published_at":"2020-03-05T15:15:11+00:00","modified_at":"2026-06-17T02:30:35+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}