CVE-2019-16057
published 2019-09-16CVE-2019-16057: The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-05-06
Exploited in the wild
EPSS
87.21%
99.7th percentile
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dns-320_firmware | <= 2.05.b10 | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/cgi-bin/login_mgr.cgi?C1=ON&cmd=login&f_type=1&f_username=admin&port=80%7Cpwd%26id&pre_pwd=1&pwd=%20&ssl=1&ssl_port=1&username=
commandport=80%7Cpwd%26id
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT DLink DNS 320 Remote Code Execution (CVE-2019-16057)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cgi-bin/login_mgr.cgi"; fast_pattern; content:"cmd|3d|login"; distance:0; content:"&port="; distance:0; pcre:"/^\d{2,5}+(?!\&|\d)/R"; reference:cve,2019-16057; reference:url,blog.cystack.net/d-link-dns-320-rce/; classtype:attempted-admin; sid:2028603; rev:2; metadata:attack_target Networking_Equipment, created_at 2019_09_18, cve CVE_2019_16057, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2020_09_02, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)- →Exploit requests target GET /cgi-bin/login_mgr.cgi with a pipe-injected command in the 'port' parameter (e.g., port=80|pwd&id). Successful exploitation returns output containing 'uid=', 'gid=', and 'pwd&id' in the HTTP response body with status 200.
- →Shodan/FOFA fingerprinting: devices exposing 'ShareCenter' or 'sharecenter' in HTML body are candidate targets for this CVE.
- →The Emerging Threats Snort rule (SID 2028603) detects exploitation by matching GET requests to /cgi-bin/login_mgr.cgi containing 'cmd=login' and '&port=' with a numeric port value not followed by '&' or another digit — indicating injected shell metacharacters.
- ·The D-Link DNS-320 is end-of-life and will not receive patches. CISA mandates disconnection rather than patching. ↗
- ·Vulnerability affects all firmware versions up to and including 2.05.B10; no patched firmware version exists for this EoL device. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q867-77vc-2rp5: The login_mgr
ghsa_unreviewed·2022-05-24
CVE-2019-16057 [HIGH] CWE-78 GHSA-q867-77vc-2rp5: The login_mgr
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
VulnCheck
D-Link DNS-320 Remote Code Execution Vulnerability
vulncheck·2019·CVSS 9.8
CVE-2019-16057 [CRITICAL] CWE-78 D-Link DNS-320 Remote Code Execution Vulnerability
D-Link DNS-320 Remote Code Execution Vulnerability
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
Affected: D-Link DNS-320 Storage Device
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.securityweek.com/flaw-gives-hackers-remote-access-files-stored-d-link-dns-320-devices; https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/; https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3; ht
CISA
D-Link DNS-320 Remote Code Execution Vulnerability
cisa·2022-04-15·CVSS 9.8
CVE-2019-16057 [CRITICAL] CWE-78 D-Link DNS-320 Remote Code Execution Vulnerability
Vulnerability: D-Link DNS-320 Remote Code Execution Vulnerability
Affected: D-Link DNS-320 Storage Device
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-16057
Remediation Due Date: 2022-05-06
Suricata
ET EXPLOIT DLink DNS 320 Remote Code Execution (CVE-2019-16057)
suricata·2019-09-18·CVSS 9.8
CVE-2019-16057 [CRITICAL] ET EXPLOIT DLink DNS 320 Remote Code Execution (CVE-2019-16057)
ET EXPLOIT DLink DNS 320 Remote Code Execution (CVE-2019-16057)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT DLink DNS 320 Remote Code Execution (CVE-2019-16057)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cgi-bin/login_mgr.cgi"; fast_pattern; content:"cmd|3d|login"; distance:0; content:"&port="; distance:0; pcre:"/^\d{2,5}+(?!\&|\d)/R"; reference:cve,2019-16057; reference:url,blog.cystack.net/d-link-dns-320-rce/; classtype:attempted-admin; sid:2028603; rev:2; metadata:attack_target Networking_Equipment, created_at 2019_09_18, cve CVE_2019_16057, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2020_09_02, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mi
Nuclei
D-Link DNS-320 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2019-16057 [CRITICAL] D-Link DNS-320 - Remote Code Execution
D-Link DNS-320 - Remote Code Execution
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
Template:
id: CVE-2019-16057
info:
name: D-Link DNS-320 - Remote Code Execution
author: DhiyaneshDk
severity: critical
description: |
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access, data loss, and potential compromise of the affected device.
remediation: |
Apply the latest firmware update provided by D-Link to mitigate this vulnerability.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2019-16057
- https://web.archive.org/web/20201222035258im_/https://blog.cystack.net/content/images/2019/09/poc.png
- ht
Unit42
Two New IoT Vulnerabilities Identified with Mirai Payloads
blogs_unit42·2020-10-14
Two New IoT Vulnerabilities Identified with Mirai Payloads
Threat Research Center
Threat Research
Vulnerabilities
## Two New IoT Vulnerabilities Identified with Mirai Payloads
Ken Hsu
Yue Guan
Vaibhav Singhal
Qi Deng
Published: October 14, 2020
Threat Research
Vulnerabilities
IoT
Mirai
## Executive Summary
Palo Alto Networks is proactively trying to safeguard its customers from attacks however possible. By leveraging its Next-Generation Firewall as sensors on the perimeter to detect malicious payloads and attack patterns, Unit 42 researchers are able to hunt down the menaces out there on the network, be they known or not.
Unit 42 researchers have taken a closer look at four Mirai variants from two recently discovered campaigns leveraging command injection vulnerability exploits that reveal a familiar IoT attack pattern.
While t
Unit42
Two New IoT Vulnerabilities Identified with Mirai Payloads
blogs_unit42·2020-10-14
Two New IoT Vulnerabilities Identified with Mirai Payloads
## Executive Summary
Palo Alto Networks is proactively trying to safeguard its customers from attacks however possible. By leveraging its Next-Generation Firewall as sensors on the perimeter to detect malicious payloads and attack patterns, Unit 42 researchers are able to hunt down the menaces out there on the network, be they known or not.
Unit 42 researchers have taken a closer look at four Mirai variants from two recently discovered campaigns leveraging command injection vulnerability exploits that reveal a familiar IoT attack pattern.
While this generic approach allows researchers to observe the entire killchain and even acquire the malware binary from the attack, this post-exploitation heuristic does have its caveat: the traffic fingerprinting. Similar services yield similar traffi
Greynoiseio
NoiseLetter September 2025
blogs_greynoiseio
NoiseLetter September 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
arXiv
A Measurement Study on the (In)security of End-of-Life (EoL) Embedded Devices
arxiv_fulltext·2021-05-29
A Measurement Study on the (In)security of End-of-Life (EoL) Embedded Devices
A Measurement Study on the (In)security of End-of-Life (EoL) Embedded Devices
Dingding Wang
Zhejiang University
China
Muhui Jiang
The Hong Kong Polytechnic University
Zhejiang University
China
Rui Chang
Zhejiang University
China
Yajin Zhou
Zhejiang University
China
Baolei Hou
Zhejiang University
China
Xiapu Luo
The Hong Kong Polytechnic University
China
Lei Wu
Zhejiang University
China
Kui Ren
Zhejiang University
China
## Abstract
Embedded devices are becoming popular. Meanwhile, researchers are actively working on improving the security
of embedded devices.
However, previous work ignores the insecurity caused by a special category of devices, i.e., the End-of-Life (EoL in short) devices.
Once a product becomes End-of-Life, vendors tend to no longer maintain its firmware
https://blog.cystack.net/d-link-dns-320-rce/https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfhttps://blog.cystack.net/d-link-dns-320-rce/https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16057
2019-09-16
Published
2022-04-15
Added to CISA KEV
Exploited in the wild