CVE-2019-20500 D-Link DWL-2600AP Access Point Command Injection

Exploited in the wild High 7.8 Published 5 Mar 2020 Updated 21 Oct 2025

Authenticated attackers can execute arbitrary OS commands on D-Link DWL-2600AP devices via shell metacharacters in the web interface configuration save parameters.

Exploited in the wild: Since 29 Jun 2023
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-20500?

CVE-2019-20500 is a high-severity command injection vulnerability in n/a, published on 5 Mar 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

Weakness: CWE-78

Which versions are affected by CVE-2019-20500?

It affects 1 product.

Products include Dlink Dwl-2600ap Firmware.

How do I fix CVE-2019-20500?

No fix has been published for CVE-2019-20500 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 20 Jul 2023.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-20500 being exploited?

Yes. Attackers have exploited CVE-2019-20500 in the wild since at least 29 Jun 2023.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-xx29-p5f4-mwr8.