Lucene search

MitreCVE-2019-16920

HistorySep 27, 2019 - 12:15 p.m.

CVE-2019-16920

2019-09-2712:15:10

CWE-78

mitre

web.nvd.nist.gov

943

In Wild

cve-2019-16920

remote code execution

d-link

dir-655c

dir-866l

dir-652

dhp-1565

dir-855l

dap-1533

dir-862l

dir-615

dir-835

dir-825

command injection

system compromise

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.97

Percentile

99.8%

JSON

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a “PingTest” device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.

Affected configurations

Nvd

Node

dlinkdir-655_firmwareRange≤3.02b05

AND

dlinkdir-655Matchcx

Node

dlinkdir-866l_firmwareRange≤1.03b04

AND

dlinkdir-866lMatchax

Node

dlinkdir-652_firmwareMatch-

AND

dlinkdir-652Matchax

Node

dlinkdhp-1565_firmwareRange≤1.01

AND

dlinkdhp-1565Matchax

Node

dlinkdir-855l_firmwareMatch-

AND

dlinkdir-855lMatch-

Node

dlinkdap-1533_firmwareMatch-

AND

dlinkdap-1533Match-

Node

dlinkdir-862l_firmwareMatch-

AND

dlinkdir-862lMatch-

Node

dlinkdir-615_firmwareMatch-

AND

dlinkdir-615Match-

Node

dlinkdir-835_firmwareMatch-

AND

dlinkdir-835Match-

Node

dlinkdir-825_firmwareMatch-

AND

dlinkdir-825Match-

VendorProductVersionCPE
dlinkdir-655_firmware*cpe:2.3:o:dlink:dir-655_firmware:*:*:*:*:*:*:*:*
dlinkdir-655cxcpe:2.3:h:dlink:dir-655:cx:*:*:*:*:*:*:*
dlinkdir-866l_firmware*cpe:2.3:o:dlink:dir-866l_firmware:*:*:*:*:*:*:*:*
dlinkdir-866laxcpe:2.3:h:dlink:dir-866l:ax:*:*:*:*:*:*:*
dlinkdir-652_firmware-cpe:2.3:o:dlink:dir-652_firmware:-:*:*:*:*:*:*:*
dlinkdir-652axcpe:2.3:h:dlink:dir-652:ax:*:*:*:*:*:*:*
dlinkdhp-1565_firmware*cpe:2.3:o:dlink:dhp-1565_firmware:*:*:*:*:*:*:*:*
dlinkdhp-1565axcpe:2.3:h:dlink:dhp-1565:ax:*:*:*:*:*:*:*
dlinkdir-855l_firmware-cpe:2.3:o:dlink:dir-855l_firmware:-:*:*:*:*:*:*:*
dlinkdir-855l-cpe:2.3:h:dlink:dir-855l:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dlink	dir-655_firmware	*	cpe:2.3:o:dlink:dir-655_firmware::::::::
dlink	dir-655	cx	cpe:2.3:h:dlink:dir-655:cx:::::::*
dlink	dir-866l_firmware	*	cpe:2.3:o:dlink:dir-866l_firmware::::::::
dlink	dir-866l	ax	cpe:2.3:h:dlink:dir-866l:ax:::::::*
dlink	dir-652_firmware	-	cpe:2.3:o:dlink:dir-652_firmware:-:::::::*
dlink	dir-652	ax	cpe:2.3:h:dlink:dir-652:ax:::::::*
dlink	dhp-1565_firmware	*	cpe:2.3:o:dlink:dhp-1565_firmware::::::::
dlink	dhp-1565	ax	cpe:2.3:h:dlink:dhp-1565:ax:::::::*
dlink	dir-855l_firmware	-	cpe:2.3:o:dlink:dir-855l_firmware:-:::::::*
dlink	dir-855l	-	cpe:2.3:h:dlink:dir-855l:-:::::::*