CVE-2019-20499

HIGH

Dlink Dwl-2600ap Firmware < 4.2.0.15 - OS Command Injection

Title source: rule

Description

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter.

Exploits (3)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotehardware

https://www.exploit-db.com/exploits/48274

View Code ZIP pw:eip

exploitdb WORKING POC

by Raki Ben Hamouda · textwebappshardware

https://www.exploit-db.com/exploits/46841

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by RAKI BEN HAMOUDA, Nick Starke · rubypocunix

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_dwl_2600_command_injection.rb

View Code ZIP pw:eip

References (3)

[Patch, Vendor Advisory] https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/46841

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/156952/DLINK-DWL-2600-Authenticated-Remote-Command-Injection.html

Scores

CVSS v3 7.8

EPSS 0.8885

EPSS Percentile 99.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (1)

dlink/dwl-2600ap_firmware < 4.2.0.15

Published Mar 05, 2020

Tracked Since Feb 18, 2026