CVE-2016-20017

CRITICALCISA KEV

9.8

Description

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie10/19/2022

Derniere modification11/5/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurD-Link

ProduitDSL-2750B Devices

Nom vulnerabiliteD-Link DSL-2750B Devices Command Injection Vulnerability

Date ajout KEV2024-01-08

Date limite remediation2024-01-29

Utilise dans ransomwareUnknown

Produits affectes

dlink:dsl-2750bdlink:dsl-2750b_firmware

Faiblesses (CWE)

CWE-77CWE-77

References

https://seclists.org/fulldisclosure/2016/Feb/53(cve@mitre.org)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088(cve@mitre.org)

https://www.exploit-db.com/exploits/44760(cve@mitre.org)

https://seclists.org/fulldisclosure/2016/Feb/53(af854a3a-2127-422b-91ae-364da2661108)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/44760(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-20017(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.