CVE-2019-20501

published 2020-03-05

CVE-2019-20501: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface…

Priority P2 68 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

EXPLOIT

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface, using shell metacharacters in the admin.cgi?action=upgrade firmwareRestore or firmwareServerip parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dwl-2600ap_firmware	<= 4.2.0.15	—

Detection & IOCs extracted from sources · hover to see the quote

url /admin.cgi?action=upgrade↗

url /admin.cgi?action=config_restore↗

url /admin.cgi?action=config_save↗

path /var/passwd↗

command cat /var/passwd↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link DWL-2600AP Command Injection Attempt (CVE-2019-20499, CVE-2019-20500, CVE-2019-20501)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin.cgi|3f|action|3d|"; startswith; fast_pattern; pcre:"/^(?:upgrade|config_(?:save|restore))$/R"; http.request_body; pcre:"/(?:firmware(?:Serverip|Restore)|config(?:Backup|Restore|Serverip)|downloadServerip)[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/P"; reference:cve,2019-20499; reference:cve,2019-20500; reference:cve,2019-20501; reference:url,unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/; reference:url,www.exploit-db.com/exploits/46841; classtype:attempted-admin; sid:2057317; rev:1; metadata:attack_target Networking_Equipment, tls_state plaintext, created_at 2024_11_07, cve CVE_2019_20499, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2024_11_07; target:dest_ip;)

• → Exploit targets POST requests to /admin.cgi with action parameter set to one of: upgrade, config_restore, or config_save. Shell metacharacters (;, |, `, $, newline) are injected into the form fields firmwareRestore, firmwareServerip, configRestore, configServerip, configBackup, or downloadServerip. ↗
• → Injection payload pattern uses semicolon-delimited commands: ;command1;same_command1;command2; — the same command is repeated twice as a bypass/confirmation technique. ↗
• → Successful exploitation results in the response containing BusyBox version string and /var/passwd contents, indicating RCE as root. Monitor HTTP responses from the device for these strings. ↗
• → The session cookie name used by the D-Link DWL-2600AP web interface is 'sessionHTTP'. Authenticated exploitation requires a valid session cookie value. ↗
• → The Snort/Suricata rule (ET sid:2057317) detects this CVE in plaintext traffic only (tls_state plaintext); encrypted sessions will not be caught by this signature. ↗
• → This vulnerability has been leveraged by a Mirai variant targeting IoT devices. Correlate exploitation attempts with subsequent botnet C2 activity. ↗

• · Affected firmware is specifically version 4.2.0.15 on Hardware Version A1. Other firmware versions may or may not be affected. ↗
• · The NVD entry attributes CVE-2019-20501 specifically to the Upgrade Firmware action (firmwareRestore / firmwareServerip parameters), while the exploit-db PoC also covers config_restore and config_save under related CVEs (CVE-2019-20499, CVE-2019-20500). The Snort rule covers all three actions under all three CVEs. ↗

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78