CVE-2019-20500
published 2020-03-05CVE-2019-20500: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web…
PriorityP184high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-07-20
Exploited in the wild
EPSS
97.11%
99.9th percentile
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dwl-2600ap_firmware | <= 4.2.0.15 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandcheck_tftp=up&configBackup=;whoami;whoami;.xml&downloadServerip=;cat /var/passwd;cat /var/passwd↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link DWL-2600AP Command Injection Attempt (CVE-2019-20499, CVE-2019-20500, CVE-2019-20501)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin.cgi|3f|action|3d|"; startswith; fast_pattern; pcre:"/^(?:upgrade|config_(?:save|restore))$/R"; http.request_body; pcre:"/(?:firmware(?:Serverip|Restore)|config(?:Backup|Restore|Serverip)|downloadServerip)[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/P"; reference:cve,2019-20499; reference:cve,2019-20500; reference:cve,2019-20501; reference:url,unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/; reference:url,www.exploit-db.com/exploits/46841; classtype:attempted-admin; sid:2057317; rev:1; metadata:attack_target Networking_Equipment, tls_state plaintext, created_at 2024_11_07, cve CVE_2019_20499, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2024_11_07; target:dest_ip;)
- →Look for POST requests to /admin.cgi with action=config_save, action=config_restore, or action=upgrade containing shell metacharacters (;, |, `, $, newline) in the configBackup, downloadServerip, configRestore, configServerip, firmwareRestore, or firmwareServerip parameters. ↗
- →The Emergint Threats Snort rule (sid:2057317) matches POST to /admin.cgi|3f|action|3d| with URI matching upgrade|config_save|config_restore and body containing shell metacharacters (%3B, %0A, %60, %7C, %24) in the vulnerable parameters.
- →Exploitation requires authenticated access; monitor for successful logins to the D-Link DWL-2600AP web interface followed immediately by POST requests to the above endpoints. ↗
- →The exploit payload pattern uses semicolon-delimited commands repeated twice (e.g., ;command1;same_command1;command2;command2) — look for this doubling pattern in POST body parameters. ↗
- →This vulnerability has been observed exploited by Mirai variants; correlate detections with known Mirai botnet infrastructure.
- ·The vulnerability is only exploitable by authenticated users; unauthenticated exploitation is not possible without valid credentials. ↗
- ·Affected firmware is specifically version 4.2.0.15 on Hardware Version A1; other versions may not be vulnerable. ↗
- ·The ET Snort rule (sid:2057317) covers three related CVEs (CVE-2019-20499, CVE-2019-20500, CVE-2019-20501) across all three vulnerable actions; a single alert may correspond to any of the three injection points.
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xx29-p5f4-mwr8: D-Link DWL-2600AP 4
ghsa_unreviewed·2022-05-24
CVE-2019-20500 [HIGH] CWE-78 GHSA-xx29-p5f4-mwr8: D-Link DWL-2600AP 4
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
VulnCheck
D-Link DWL-2600AP Access Point Command Injection Vulnerability
vulncheck·2019·CVSS 7.8
CVE-2019-20500 [HIGH] CWE-78 D-Link DWL-2600AP Access Point Command Injection Vulnerability
D-Link DWL-2600AP Access Point Command Injection Vulnerability
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Affected: D-Link DWL-2600AP Access Point
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Exploitation References: https://unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2023-07-20
CISA
D-Link DWL-2600AP Access Point Command Injection Vulnerability
cisa·2023-06-29·CVSS 7.8
CVE-2019-20500 [HIGH] CWE-78 D-Link DWL-2600AP Access Point Command Injection Vulnerability
Vulnerability: D-Link DWL-2600AP Access Point Command Injection Vulnerability
Affected: D-Link DWL-2600AP Access Point
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Notes: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113; https://nvd.nist.gov/vuln/detail/CVE-2019-20500
Remediation Due Date: 2023-07-20
Suricata
ET WEB_SPECIFIC_APPS D-Link DWL-2600AP Command Injection Attempt (CVE-2019-20499, CVE-2019-20500, CVE-2019-20501)
suricata·2024-11-07·CVSS 7.8
CVE-2019-20499 [HIGH] ET WEB_SPECIFIC_APPS D-Link DWL-2600AP Command Injection Attempt (CVE-2019-20499, CVE-2019-20500, CVE-2019-20501)
ET WEB_SPECIFIC_APPS D-Link DWL-2600AP Command Injection Attempt (CVE-2019-20499, CVE-2019-20500, CVE-2019-20501)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link DWL-2600AP Command Injection Attempt (CVE-2019-20499, CVE-2019-20500, CVE-2019-20501)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin.cgi|3f|action|3d|"; startswith; fast_pattern; pcre:"/^(?:upgrade|config_(?:save|restore))$/R"; http.request_body; pcre:"/(?:firmware(?:Serverip|Restore)|config(?:Backup|Restore|Serverip)|downloadServerip)[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/P"; reference:cve,2019-20499; reference:cve,2019-20500; reference:cve,2019-20501; reference:url,unit42.paloaltonetworks.com/mirai-variant-targets-
Unit42
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
blogs_unit42·2023-06-22·CVSS 9.8
CVE-2019-12725 [CRITICAL] IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
## Executive Summary
Since March 2023, Unit 42 researchers have observed threat actors leveraging several IoT vulnerabilities to spread a variant of the Mirai botnet. The vulnerabilities exploited include those listed in the following table:
CVE/Product
Description
CVE-2019-12725
Zeroshell Remote Command Execution Vulnerability
CVE-2019-17621
D-Link DIR-859 Remote Command Injection Vulnerability
CVE-2019-20500
D-Link DWL-2600AP Remote Command Execution Vulnerability
CVE-2021-25296
Nagios XI Remote Command Injection Vulnerability
CVE-2021-46422
Telesquare SDT-CW3B1 Router Command Injection Vulnerability
CVE-2022-27002
Arris TR3300 Remote Command Injection Vulnerability
CVE-2022-29303
SolarView Compact Command Injection Vulnerability
CVE-2022-30023
Tenda HG9 Router Command Injectio
Unit42
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
blogs_unit42·2023-06-22·CVSS 9.8
CVE-2019-12725 [CRITICAL] IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Threat Research Center
Trend Reports
Vulnerabilities
## IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Chao Lei
Zhibin Zhang
Yiheng An
Cecilia Hu
Published: June 22, 2023
Trend Reports
Vulnerabilities
Botnet
CVE-2019-12725
CVE-2019-17621
CVE-2019-20500
CVE-2021-25296
CVE-2021-46422
CVE-2022-27002
CVE-2022-29303
CVE-2022-30023
CVE-2022-30525
CVE-2022-31499
CVE-2022-36266
CVE-2022-40005
CVE-2022-45699
CVE-2023-1389
CVE-2023-25280
CVE-2023-27240
IoT
IoT Security
Mirai
## Executive Summary
Since March 2023, Unit 42 researchers have observed threat actors leveraging several IoT vulnerabilities to spread a variant of the Mirai botnet. The vulnerabilities exploited include those listed in the following table:
CVE/Pro
Greynoiseio
Trinity Cyber + GreyNoise: Sharing Intelligence to Protect Internet Citizens
blogs_greynoiseio·CVSS 8.8
[HIGH] Trinity Cyber + GreyNoise: Sharing Intelligence to Protect Internet Citizens
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113https://www.exploit-db.com/exploits/46841https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113https://www.exploit-db.com/exploits/46841https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-20500
2020-03-05
Published
2023-06-29
Added to CISA KEV
Exploited in the wild