CVE-2016-20017: D-Link DSL-2750B Devices Command Injection Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-01-08
EPSS: 65.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-19 · updated 2026-06-17
Weakness: CWE-77

Description

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

Affected products

Dlink Dsl-2750B Firmware: before 1.05 — fixed in 1.05

How to fix

Upgrade to a fixed version: Dlink Dsl-2750B Firmware 1.05. Check the vendor advisory for mitigations.

References

https://seclists.org/fulldisclosure/2016/Feb/53
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088
https://www.exploit-db.com/exploits/44760
https://seclists.org/fulldisclosure/2016/Feb/53
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088
https://www.exploit-db.com/exploits/44760
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-20017

Get alerted when CVE-2016-20017 or the next vulnerability affects your stack