CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Jul 20, 2023

CVE-2019-20500

High

EPSS 92.2%CISA KEV

D-Link/DWL-2600AP Access Point

Description

D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

EPSS — Exploit Probability

92.2%

Higher than 99.7% of all CVEs

Required Action

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113; https://nvd.nist.gov/vuln/detail/CVE-2019-20500

Risk Assessment

HIGH

In CISA KEV

High EPSS

Details

Severity: High
EPSS: 92.2%
CISA KEV: Yes
Ransomware: Unknown
Articles: 0

Timeline

Published

Jun 29, 2023

Added to KEV

Jun 29, 2023

Remediation Due

Jul 20, 2023

Affected Product

D-Link

DWL-2600AP Access Point

View all D-Link CVEs

External Links

NVD (NIST)CVE Details MITRE CVE