---
id: "CVE-2019-20500"
kind: "vulnerability"
aliases: ["CVE-2019-20500"]
title: "dlink dwl-2600ap firmware: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save\u2026"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "D-Link DWL-2600AP Access Point", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dwl-2600ap firmware", "fixed": [], "affected": "<= 4.2.0.15", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["d-link", "dwl-2600ap", "exploited", "infrastructure", "wireless-access-point"]
not_affected_if: ["no-dwl-2600ap-devices", "web-interface-restricted-to-trusted-admins"]
published_at: "2020-03-05T15:15:11+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-20500", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20500", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# dlink dwl-2600ap firmware: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save…

D-Link DWL-2600AP wireless access points have a command injection flaw in the web interface's Save Configuration function. An attacker who is logged in can inject shell commands through the configBackup or downloadServerip parameter and run them on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:D-Link DWL-2600AP Access Point affected ? fixed ?
- vendor:dlink dwl-2600ap firmware affected <= 4.2.0.15 fixed ?

## How to check

Identify DWL-2600AP devices on the network and check their firmware version against the vendor advisory; the sources do not give a version check command.

## Fix

Apply the vendor update per D-Link instructions, or remove the device from service if no update is available (CISA directive).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-20500
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-20500

## From the sources

D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_