CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2016-20017

CVSS 9.8v3.1pub. 2022-10-19upd. 2025-11-05

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dlink Dsl 2750b

    HW
    Dlink
    all versions

  • Dlink Dsl 2750b Firmware

    OS
    Dlink
    < 1.05

CISA KEV — detailsi

Vendori
D-Link
Producti
DSL-2750B Devices
Added to KEVi
January 8, 2024
Remediation deadline (US Federal)i
January 29, 2024(overdue)
Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 29 stycznia 2024
CWE
References

Related vulnerabilities

CVE-2024-3272CRITICAL9.8⚠ KEVPL ✓same vendor

D-Link DNS-320L/325/327L/340L — zakodowane na stałe poświadczenia (hard-coded credentials)

CVE-2023-25280CRITICAL9.8⚠ KEVPL ✓same vendor

Command Injection w D-Link DIR-820L umożliwiający eskalację uprawnień do root

CVE-2022-37055CRITICAL9.8⚠ KEVPL ✓same vendor

Buffer overflow w D-Link Go-RT-AC750 via cgibin/hnap_main — RCE bez uwierzytelnienia

CVE-2022-26258CRITICAL9.8⚠ KEVPL ✓same vendor

RCE w D-Link DIR-820L — command injection przez HTTP POST

CVE-2021-45382CRITICAL9.8⚠ KEVPL ✓same vendor

RCE w routerach D-Link via DDNS — funkcja w pliku binarnym ncc2