CVE-2019-16920

CVE-2019-16920 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 25, 2022, with confirmed use in ransomware campaigns. EIP tracks 1 public exploit from researchers including eniac888. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains functional exploit code for CVE-2019-16920, which targets unauthenticated remote code execution in multiple D-Link routers via command injection in the 'PingTest' CGI interface. The exploits demonstrate both single-target and mass exploitation capabilities.

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.