CVE-2019-16920

{"id": "CVE-2019-16920", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-09-27T12:15:10.017", "references": [{"url": "https://fortiguard.com/zeroday/FG-VD-19-117", "tags": ["Broken Link", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.kb.cert.org/vuls/id/766427", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "https://www.seebug.org/vuldb/ssvid-98079", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a \"PingTest\" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825."}, {"lang": "es", "value": "La ejecuci\u00f3n de c\u00f3digo remota no autenticada se presenta en productos D-Link tales como DIR-655C, DIR-866L, DIR-652, y DHP-1565. El problema se presenta cuando el atacante env\u00eda una entrada arbitraria hacia una interfaz de la puerta de enlace com\u00fan del dispositivo \"PingTest\" que podr\u00eda conllevar a una inyecci\u00f3n com\u00fan. Un atacante que activa con \u00e9xito la inyecci\u00f3n de comando podr\u00eda lograr un compromiso total del sistema. Despu\u00e9s, se descubri\u00f3 de manera independiente que estos tambi\u00e9n se ven afectados: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835 y DIR-825."}], "lastModified": "2024-07-16T17:54:26.153", "cisaActionDue": "2022-04-15", "cisaExploitAdd": "2022-03-25", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-655_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "525853B4-1C30-4D96-AD4F-26FD77469B33", "versionEndIncluding": "3.02b05"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-655:cx:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8F90F9E0-0F90-4AFD-868C-370882C47248"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-866l_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA174575-0468-4AB1-A504-B5AA559D3219", "versionEndIncluding": "1.03b04"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-866l:ax:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "52177D2B-D7F8-4351-A169-FDF6A5FBF44D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-652_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1147272F-0F23-4606-A84E-CA971414C65B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-652:ax:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E4D52D3-71FD-4D29-881A-393B35F3DB65"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dhp-1565_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "369D2C8E-89F1-4E03-8DA0-BA2DB1245569", "versionEndIncluding": "1.01"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dhp-1565:ax:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BAFB86EA-966B-4DB3-9B81-198878D76573"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-855l_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "239F0015-2834-4DBB-B115-58871D0FF764"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-855l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7EB62BC4-69BC-40D7-A8E7-F5728B827250"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dap-1533_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB7D656D-47B5-4269-A155-741D60F818CD"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dap-1533:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0D3E4627-940F-4859-BC67-B6229BC0AFD8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-862l_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "380A4761-5474-4F52-A4EE-62844D5EE82C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-862l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0552E33F-BB39-4701-B91A-1DB33992505C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-615_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C55E6D4-820D-469F-A343-635A621C0D7C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-615:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E92E959-C211-4979-A233-163BEFCF6F0D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-835_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCFE0993-C19A-4C60-B8C6-E549D748537A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-835:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D1B91013-E79E-4076-916D-D52D6E417EA7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-825_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEC49DA6-D1F4-4A2A-904E-907356F3C804"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-825:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7038F8A9-03F3-4442-B371-84801EF05447"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org", "cisaRequiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "cisaVulnerabilityName": "D-Link Multiple Routers Command Injection Vulnerability"}