ZeroDay Findings
Sign inSign up

Findings

CVE-2019-16920

D-Link Multiple Routers Command Injection Vulnerability

Published Sep 27, 2019 · updated Jun 16, 2026 · dlink dir-655 firmware

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 27, 2019 · Catalog

    Detected

    Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that the

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that the

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date Apr 15, 2022

Affected

  • cpe dlink/dap-1533 firmwareversion unspecified
  • cpe dlink/dhp-1565 firmwareversion unspecified
  • cpe dlink/dir-615 firmwareversion unspecified
  • cpe dlink/dir-652 firmwareversion unspecified
  • cpe dlink/dir-655 firmwareversion unspecified
  • cpe dlink/dir-825 firmwareversion unspecified
  • cpe dlink/dir-835 firmwareversion unspecified
  • cpe dlink/dir-855l firmwareversion unspecified
  • cpe dlink/dir-862l firmwareversion unspecified
  • cpe dlink/dir-866l firmwareversion unspecified
  • vendor D-Link Multiple Routersversion unspecified

Sources

  • CISA KEVCVE-2019-16920

    Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.

    cisa.gov
  • CVE.orgCVE-2019-16920

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-16920

    30-day exploitation probability 100.0%

    first.org
  • NIST NVDCVE-2019-16920

    Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who succ

    nvd.nist.gov

References

CVE-2019-16920 · ZeroDay Findings