D-Link · DSL-2750B Devices
The D-Link DSL-2750B devices, before firmware version 1.05, contain a command injection flaw in the login.cgi handler, where the cli parameter is not properly neutralised. An attacker with network access to the device can send a crafted request without authenticating or any user interaction, enabling arbitrary command execution on the device.
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
First seen exploited 4 years before it was disclosed. Public exploit code (Metasploit) was available 7 years before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Unauthenticated remote exploit via public web interface
remote unauthenticated command injection via the login.cgi cli parameter
Command injection yields OS command execution
remote unauthenticated command injection via the login.cgi cli parameter
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2016-20017 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Microsoft researchers have also identified that previous reports have used the vulnerability ID “ZERO-32906” for CVE-2018-20057, “GPON” for CVE-2018-10561, and “DLINK” for CVE-2016-20017; and that CVE-2020-7209 was mislabeled as CVE-2017-17106 and CVE-2022-42013 was mislabeled as CVE-2021-42013.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.