Details of VAR-201909-0903

ID

VAR-201909-0903

CVE

CVE-2019-16920

TITLE

Multiple D-Link routers vulnerable to remote command execution

Trust: 0.8

sources: CERT/CC: VU#766427

DESCRIPTION

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. plural D-Link The product includes OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-Link DIR-655C, etc. are all wireless routers from Taiwan D-Link. Attackers can use this vulnerability to inject commands to invade the system. The following products and versions are affected: D-Link DIR-655C; DIR-866L; DIR-652; DHP-1565, etc. Exploiting this issue could allow an malicious user to execute arbitrary commands in the context of the affected device. Failed exploit attempts will likely result in denial-of-service conditions

Trust: 3.06

sources: NVD: CVE-2019-16920 // CERT/CC: VU#766427 // JVNDB: JVNDB-2019-009977 // CNVD: CNVD-2019-33820 // VULHUB: VHN-149115 // VULMON: CVE-2019-16920

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-33820

AFFECTED PRODUCTS

vendor:	dlink	model:	dir-652	scope:	eq	version:	-	Trust: 1.6
vendor:	d link	model:	dhp-1565	scope:	-	version:	-	Trust: 1.4
vendor:	d link	model:	dir-652	scope:	-	version:	-	Trust: 1.4
vendor:	d link	model:	dir-866l	scope:	-	version:	-	Trust: 1.4
vendor:	dlink	model:	dir-655	scope:	lte	version:	3.02b05	Trust: 1.0
vendor:	dlink	model:	dir-855l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dir-825	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dir-835	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dir-862l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dhp-1565	scope:	lte	version:	1.01	Trust: 1.0
vendor:	dlink	model:	dir-615	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dir-866l	scope:	lte	version:	1.03b04	Trust: 1.0
vendor:	dlink	model:	dap-1533	scope:	eq	version:	-	Trust: 1.0
vendor:	d link	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dir-655	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dir-655c	scope:	-	version:	-	Trust: 0.6
vendor:	dlink	model:	dir-652	scope:	eq	version:	ax	Trust: 0.6
vendor:	dlink	model:	dir-655	scope:	eq	version:	cx	Trust: 0.6
vendor:	dlink	model:	dir-866l	scope:	eq	version:	ax	Trust: 0.6
vendor:	dlink	model:	dhp-1565	scope:	eq	version:	ax	Trust: 0.6

sources: CERT/CC: VU#766427 // CNVD: CNVD-2019-33820 // JVNDB: JVNDB-2019-009977 // CNNVD: CNNVD-201909-1326 // NVD: CVE-2019-16920

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-16920
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2019-16920
value:	HIGH
Trust: 0.8
NVD:	CVE-2019-16920
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2019-33820
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201909-1326
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-149115
value:	HIGH
Trust: 0.1
VULMON:	CVE-2019-16920
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-16920
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
NVD:	CVE-2019-16920
severity:	HIGH
baseScore:	10.0
vectorString:	NONE
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2019-33820
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-149115
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-16920
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-16920
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CERT/CC: VU#766427 // CNVD: CNVD-2019-33820 // VULHUB: VHN-149115 // VULMON: CVE-2019-16920 // JVNDB: JVNDB-2019-009977 // CNNVD: CNNVD-201909-1326 // NVD: CVE-2019-16920

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.9

sources: VULHUB: VHN-149115 // JVNDB: JVNDB-2019-009977 // NVD: CVE-2019-16920

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201909-1326

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201909-1326

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-009977

EXPLOIT AVAILABILITY

sources: CERT/CC: VU#766427

PATCH

title:	Top Page	url:	https://www.dlink.com/en/consumer	Trust: 0.8
title:	myscan	url:	https://github.com/amcai/myscan	Trust: 0.1

sources: VULMON: CVE-2019-16920 // JVNDB: JVNDB-2019-009977

EXTERNAL IDS

db:	NVD	id:	CVE-2019-16920	Trust: 4.0
db:	CERT/CC	id:	VU#766427	Trust: 1.9
db:	SEEBUG	id:	SSVID-98079	Trust: 1.7
db:	JVN	id:	JVNVU95198984	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-009977	Trust: 0.8
db:	CNNVD	id:	CNNVD-201909-1326	Trust: 0.7
db:	CNVD	id:	CNVD-2019-33820	Trust: 0.6
db:	VULHUB	id:	VHN-149115	Trust: 0.1
db:	VULMON	id:	CVE-2019-16920	Trust: 0.1

REFERENCES

url:	https://fortiguard.com/zeroday/fg-vd-19-117	Trust: 3.1
url:	https://www.seebug.org/vuldb/ssvid-98079	Trust: 1.7
url:	https://medium.com/@80vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3	Trust: 1.5
url:	https://www.kb.cert.org/vuls/id/766427	Trust: 1.1
url:	https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3	Trust: 1.0
url:	https://www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce.html	Trust: 0.8
url:	https://tools.ietf.org/html/rfc3875	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-16920	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu95198984/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2019-16920	Trust: 0.8

sources: CERT/CC: VU#766427 // CNVD: CNVD-2019-33820 // VULHUB: VHN-149115 // JVNDB: JVNDB-2019-009977 // CNNVD: CNNVD-201909-1326 // NVD: CVE-2019-16920

SOURCES

db:	CERT/CC	id:	VU#766427
db:	CNVD	id:	CNVD-2019-33820
db:	VULHUB	id:	VHN-149115
db:	VULMON	id:	CVE-2019-16920
db:	JVNDB	id:	JVNDB-2019-009977
db:	CNNVD	id:	CNNVD-201909-1326
db:	NVD	id:	CVE-2019-16920

LAST UPDATE DATE

2024-11-23T22:11:50.020000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#766427	date:	2019-10-25T00:00:00
db:	CNVD	id:	CNVD-2019-33820	date:	2019-09-29T00:00:00
db:	VULHUB	id:	VHN-149115	date:	2019-10-10T00:00:00
db:	VULMON	id:	CVE-2019-16920	date:	2023-11-07T00:00:00
db:	JVNDB	id:	JVNDB-2019-009977	date:	2019-11-08T00:00:00
db:	CNNVD	id:	CNNVD-201909-1326	date:	2019-10-24T00:00:00
db:	NVD	id:	CVE-2019-16920	date:	2024-11-21T04:31:20.637

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#766427	date:	2019-10-23T00:00:00
db:	CNVD	id:	CNVD-2019-33820	date:	2019-09-29T00:00:00
db:	VULHUB	id:	VHN-149115	date:	2019-09-27T00:00:00
db:	VULMON	id:	CVE-2019-16920	date:	2019-09-27T00:00:00
db:	JVNDB	id:	JVNDB-2019-009977	date:	2019-10-03T00:00:00
db:	CNNVD	id:	CNNVD-201909-1326	date:	2019-09-27T00:00:00
db:	NVD	id:	CVE-2019-16920	date:	2019-09-27T12:15:10.017