CVE-2019-20500
D-Link DWL-2600AP Access Point Command Injection Vulnerability
Published Mar 5, 2020 · updated Jun 16, 2026 · dlink dwl-2600ap firmware
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Timeline
Detection, updates, and resolution for this record.
Mar 5, 2020 · Catalog
Detected
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Jun 29, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Jul 20, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Jun 16, 2026 · Catalog
Updated
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Required action
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CISA due date Jul 20, 2023
Affected
- cpe dlink/dwl-2600ap firmwareversion unspecified
- vendor D-Link DWL-2600AP Access Pointversion unspecified
Sources
- CISA KEVCVE-2019-20500
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
cisa.gov - CVE.orgCVE-2019-20500
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-20500
30-day exploitation probability 96.7%
first.org - Exploit Database46841
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDCVE-2019-20500
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
nvd.nist.gov