{"id":"CVE-2019-16920","published":"2019-09-27T12:15:10Z","modified":"2026-06-17T02:22:57Z","title":"D-Link Multiple Routers Command Injection Vulnerability","vendor":"D-Link","product":"Multiple Routers","tier":"core","eol":null,"description":{"text":"Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a \"PingTest\" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw exists in the \"PingTest\" device common gateway interface of multiple D-Link routers, including the DIR-655C, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. An unauthenticated remote attacker who sends crafted input to that interface over the network, with no user interaction required, can inject operating system commands and achieve full compromise of the affected device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:37Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99996,"percentile":0.99989,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-16920","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-09-16","exploitedFirstSeen":"2020-09-16","ransomware":true,"evidence":[{"url":"https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer","date":"2020-09-16"},{"url":"https://www.bleepingcomputer.com/news/security/us-charges-chinese-winnti-hackers-for-attacking-100-plus-companies/","date":"2020-09-17"},{"url":"https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/","date":"2020-10-14"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-275a","date":"2020-10-20"},{"url":"https://www.avira.com/en/blog/a-gafgyt-variant-that-exploits-pulse-secure-cve-2020-8218","date":"2020-12-07"},{"url":"https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/","date":"2021-03-04"},{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf","date":"2022-01-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"}],"evidenceTotal":828,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://fortiguard.com/zeroday/FG-VD-19-117","tags":["Broken Link","Third Party Advisory"]},{"url":"https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/766427","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.seebug.org/vuldb/ssvid-98079","tags":["Exploit","Third Party Advisory"]},{"url":"https://fortiguard.com/zeroday/FG-VD-19-117","tags":["Broken Link","Third Party Advisory"]},{"url":"https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/766427","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.seebug.org/vuldb/ssvid-98079","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated attack via public-facing device interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Unauthenticated remote code execution occurs in D-Link products","start":0,"end":63}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection yields arbitrary OS command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could achieve full system compromise","start":320,"end":356}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-7414","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7414","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2019-10-16","earliestUrl":"https://github.com/eniac888/CVE-2019-16920-MassPwn3r","repos":[{"name":"eniac888/CVE-2019-16920-MassPwn3r","url":"https://github.com/eniac888/CVE-2019-16920-MassPwn3r","stars":1,"created":"2019-10-16"}]},"nuclei":[{"id":"CVE-2019-16920","name":"D-Link Routers - Remote Code Execution","severity":"critical","path":"http/cves/2019/CVE-2019-16920.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16920.yaml"}],"first":{"date":"2019-10-16","source":"PoC-in-GitHub","url":"https://github.com/eniac888/CVE-2019-16920-MassPwn3r"},"provenance":"source"},"exploitRefs":["https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3","https://www.seebug.org/vuldb/ssvid-98079"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-09-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16920","provenance":"source"},{"date":"2019-10-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/eniac888/CVE-2019-16920-MassPwn3r","provenance":"source"},{"date":"2020-09-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7414","provenance":"source"}],"speed":{"daysToPublicExploit":19,"firstExploitFrom":"PoC-in-GitHub","daysToKev":910},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2235 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-d-link-multiple-routers-cwe-78"}}