CVE-2019-16057

What is the D-Link DNS-320?

The DNS-320 is a consumer/small-office network-attached storage (NAS) device from D-Link, used for local file sharing and backup. Like many consumer NAS and router products, it runs an embedded Linux firmware with a web-based CGI management interface — a common source of command-injection vulnerabilities when user input reaches shell commands without sanitization.

Overview

CVE-2019-16057 is a critical remote code execution vulnerability in the D-Link DNS-320's login_mgr.cgi script. An unauthenticated remote attacker can send a crafted request to the CGI endpoint to inject and execute arbitrary operating-system commands on the device. CVSS 3.1 base score 9.8 (Critical), with no authentication or user interaction required.

Technical Details

This is CWE-78 (OS Command Injection). The login_mgr.cgi script constructs a shell command using attacker-supplied parameters (such as login credentials or session-related fields) without properly escaping shell metacharacters, allowing an attacker to append additional commands that the underlying system executes. Because the CGI script runs with elevated privileges as part of the device's web management stack, successful exploitation gives the attacker full control of the NAS, including access to any files stored on it.

Discovery

The vulnerability was disclosed through standard vulnerability-coordination channels; D-Link's response noted that the DNS-320 had reached end-of-life status, meaning no firmware patch was produced to resolve the flaw.

Exploitation Context

CISA added CVE-2019-16057 to the KEV catalog in April 2022 and flags it as used in ransomware operations. Because the device is end-of-life with no vendor patch available, CISA's required action for federal agencies is to disconnect the product if still in use — a strong signal that it continues to be actively targeted, including by botnets that scan the internet for exposed NAS devices to compromise for data theft, cryptomining, or as DDoS infrastructure.

Remediation

1. Discontinue use of the D-Link DNS-320 — it is end-of-life and will not receive a security patch for this vulnerability.
2. If continued use is unavoidable, remove it from direct internet exposure immediately and place it behind a firewall accessible only from a trusted internal network.
3. Migrate data and NAS functionality to a currently supported, patched storage platform.
4. Change default credentials and disable any unnecessary remote-management features on any legacy D-Link devices still in service.
5. Monitor network traffic for signs of compromise (unexpected outbound connections, unrecognized processes) on any device that cannot be immediately retired.