CVE-2019-20499

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/156952/DLINK-DWL-2600-Authenticated-Remote-Command-Injection.html
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113Patch, Vendor Advisory
https://www.exploit-db.com/exploits/46841Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/156952/DLINK-DWL-2600-Authenticated-Remote-Command-Injection.html
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113Patch, Vendor Advisory
https://www.exploit-db.com/exploits/46841Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-20507.8In tearDownClientInterface of WificondControl.java, there is a possible use after free due to improper locking. This could lead to local esc CVE-2019-205007.8D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality i CVE-2019-205017.8D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in CVE-2019-205027.5An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter.CVE-2019-205036.5usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.CVE-2019-205049.8service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code v CVE-2019-20517.5In heap of spaces.h, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosu CVE-2019-205116.1ERPNext 11.1.47 allows blog?blog_category= Frame Injection.CVE-2019-205126.1Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.CVE-2019-205136.1Open edX Ironwood.1 allows support/certificates?user= reflected XSS.CVE-2019-205146.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.CVE-2019-205156.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.