CVE-2016-20017

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
dlinkdsl-2750b_firmware
𝑥
< 1.05
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://seclists.org/fulldisclosure/2016/Feb/53
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088
https://www.exploit-db.com/exploits/44760
https://seclists.org/fulldisclosure/2016/Feb/53
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088
https://www.exploit-db.com/exploits/44760
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-20017