CVE-2019-20499: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web…

PriorityP269high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EXPLOIT

EPSS

96.64%

99.9th percentile

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dwl-2600ap_firmware	<= 4.2.0.15	—

Detection & IOCsextracted from sources · hover to see the quote

url/admin.cgi?action=config_restore↗

url/admin.cgi?action=config_save↗

url/admin.cgi?action=upgrade↗

path/var/passwd↗

command;cat /var/passwd;cat /var/passwd↗

command; ${cmd} ;↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link DWL-2600AP Command Injection Attempt (CVE-2019-20499, CVE-2019-20500, CVE-2019-20501)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin.cgi|3f|action|3d|"; startswith; fast_pattern; pcre:"/^(?:upgrade|config_(?:save|restore))$/R"; http.request_body; pcre:"/(?:firmware(?:Serverip|Restore)|config(?:Backup|Restore|Serverip)|downloadServerip)[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/P"; reference:cve,2019-20499; reference:cve,2019-20500; reference:cve,2019-20501; reference:url,unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/; reference:url,www.exploit-db.com/exploits/46841; classtype:attempted-admin; sid:2057317; rev:1; metadata:attack_target Networking_Equipment, tls_state plaintext, created_at 2024_11_07, cve CVE_2019_20499, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2024_11_07; target:dest_ip;)

→Exploit targets POST requests to /admin.cgi with action parameter set to config_restore, config_save, or upgrade; shell metacharacters (;, |, `, $, newline) are injected into the form-data fields configRestore, configServerip, configBackup, downloadServerip, firmwareRestore, or firmwareServerip. ↗
→The Snort/ET rule body regex matches shell metacharacter injection in POST body parameters: semicolon (%3B/;), newline (%0A), backtick (%60), pipe (%7C), or dollar sign (%24) following the vulnerable parameter names.
→The Metasploit module extracts a session token from the login response body using the JavaScript variable pattern 'var cookieValue = "' and sets it as the sessionHTTP cookie for subsequent exploit requests. ↗
→Authentication to the device uses POST to /admin.cgi with form fields i_username, i_password, and login=Logon; default credentials are admin/admin. ↗
→The exploit uses multipart/form-data with an optprotocol field set to 'up' alongside the injected parameter; this combination in a POST to /admin.cgi is a strong indicator of exploitation. ↗
→The Metasploit module uses wget-based CmdStager (CmdStagerFlavor :wget) targeting Linux MIPS little-endian architecture, so look for wget-based payload delivery on MIPS devices. ↗

·Exploitation requires prior authentication; the attacker must possess valid credentials (default: admin/admin) before injecting commands. ↗
·The ET Snort rule (sid:2057317) is marked tls_state plaintext, meaning it will not detect exploitation over HTTPS/TLS-encrypted sessions.
·The injected commands run as root on the device, as confirmed by the PoC response showing root in /var/passwd; any detection or response should treat this as a full device compromise. ↗

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.