CVE-2016-20017 D-Link DSL-2750B Devices Command Injection
Remote unauthenticated attackers can execute arbitrary commands on D-Link DSL-2750B routers via the login.cgi cli parameter.
- Exploited in the wild
- Since 8 Jan 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-20017?
CVE-2016-20017 is a critical command injection vulnerability in n/a, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
Weakness: CWE-77
Which versions are affected by CVE-2016-20017?
It affects 1 product.
Products include Dlink Dsl-2750b Firmware.
How do I fix CVE-2016-20017?
No fix has been published for CVE-2016-20017 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 29 Jan 2024.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-20017 being exploited?
Yes. Attackers have exploited CVE-2016-20017 in the wild since at least 8 Jan 2024.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-4gf4-mg8f-6224.