CVE-2019-16057
D-Link DNS-320 Remote Code Execution Vulnerability
Published Sep 16, 2019 · updated Jun 16, 2026 · dlink dns-320 firmware
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
Timeline
Detection, updates, and resolution for this record.
Sep 16, 2019 · Catalog
Detected
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
Apr 15, 2022 · CISA KEV
Known exploited
The impacted product is end-of-life and should be disconnected if still in use.
May 6, 2022 · CISA KEV
Remediation due
The impacted product is end-of-life and should be disconnected if still in use.
Jun 16, 2026 · Catalog
Updated
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
Required action
The impacted product is end-of-life and should be disconnected if still in use.
CISA due date May 6, 2022
Affected
- cpe dlink/dns-320 firmwareversion unspecified
- vendor D-Link DNS-320 Storage Deviceversion unspecified
Sources
- CISA KEVCVE-2019-16057
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
cisa.gov - CVE.orgCVE-2019-16057
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-16057
30-day exploitation probability 86.5%
first.org - NIST NVDCVE-2019-16057
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
nvd.nist.gov