Exploitation Summary
CVE-2016-20017 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 8, 2024.
EIP tracks 2 public exploits from researchers including Metasploit, p@ql, including a Metasploit module exploits/linux/http/dlink_dsl2750b_exec_noauth.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in D-Link DSL-2750B devices via the 'cli' parameter in the 'login.cgi' endpoint. It uses a cmdstager to deliver a payload for remote code execution on vulnerable firmware versions (1.01 to 1.03).
Description
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
Exploits (2)
This Metasploit module exploits a command injection vulnerability in D-Link DSL-2750B devices via the 'cli' parameter in the 'login.cgi' endpoint. It uses a cmdstager to deliver a payload for remote code execution on vulnerable firmware versions (1.01 to 1.03).
This Metasploit module exploits a command injection vulnerability in D-Link DSL-2750B devices via the 'cli' parameter in the 'login.cgi' endpoint. It leverages the 'ayecli' binary to execute arbitrary commands without authentication.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H