CVE-2019-16920

What are the Affected D-Link Routers?

The affected D-Link router models (including several DIR-series home and small-office wireless routers) are consumer networking devices that provide internet gateway, Wi-Fi, and basic firewall functionality. Their web-management interfaces run on embedded Linux firmware with CGI-based configuration scripts — a pattern that has repeatedly produced command-injection vulnerabilities across many D-Link product lines.

Overview

CVE-2019-16920 is a critical command injection vulnerability affecting multiple D-Link router models. An unauthenticated remote attacker can send a crafted request to a vulnerable management endpoint and achieve full system compromise of the device. CVSS 3.1 base score 9.8 (Critical).

Technical Details

This is CWE-78 (OS Command Injection). The vulnerable endpoint(s) in the router's management interface build a shell command using attacker-controlled input — typically a device or network-configuration parameter — without properly sanitizing shell metacharacters. Because the management CGI processes run with elevated privileges on the device's embedded Linux operating system, successful injection gives the attacker root-level control of the router, including the ability to modify firmware, intercept traffic, and use the device as a launch point for further attacks.

Discovery

The vulnerability affecting multiple D-Link router models was disclosed through standard vulnerability-coordination channels; several of the affected models were end-of-life or near end-of-life at the time of disclosure, limiting the availability of official patches for some devices.

Exploitation Context

CISA added CVE-2019-16920 to the KEV catalog in March 2022, and its required action notes that impacted end-of-life products should be disconnected if still in use. Consumer and small-office routers like these affected D-Link models have long been prime targets for IoT botnets (in the lineage of Mirai and its many variants), which scan the internet continuously for exposed, vulnerable devices to recruit for DDoS attacks and other malicious infrastructure.

Remediation

1. Apply the D-Link firmware update addressing CVE-2019-16920 for your specific model, if one has been released.
2. If your specific model is end-of-life with no available patch, discontinue use and replace it with a currently supported device.
3. Disable remote/WAN-side management access on any affected router; restrict configuration to the trusted LAN only.
4. Change default credentials on all network devices, since many exploitation attempts against consumer routers combine command injection with weak default logins.
5. Monitor for firmware integrity issues or unexpected outbound traffic that could indicate the device has been recruited into a botnet.