CVE DatabaseCVE-2016-20017

Updated 2026-06-17한국어 권고문 →

CVE-2016-200179.8/CRITICALCISA KEVCWE-77CWE-77

D-Link DSL-2750B login.cgi Remote Command Injection Vulnerability (CVE-2016-20017) Technical Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

d-link

Affected Components

dsl-2750b

Published Date

2022-10-19

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

65.8%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

D-Link DSL-2750B devices running firmware versions prior to 1.05

Impact

Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the 'cli' parameter in login.cgi

Mitigation

Apply the official firmware patch (v1.05 or later) or immediately disable WAN-side access to the web management interface

Affected Products & Version Scope

All D-Link DSL-2750B devices running firmware versions prior to 1.05 (actively exploited in the wild)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official firmware update (v1.05 or higher) provided by D-Link. If CLI access is available, you can download and flash the firmware using the following commands:

bash

# 1. Download the official patched firmware image
wget https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088 -O dlink_firmware.bin

# 2. Flash the firmware using the system upgrade utility
sysupgrade -v dlink_firmware.bin

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict WAN-side access to the administration interface using firewall rules:

bash

# Block external HTTP/HTTPS access on the WAN interface (e.g., eth0)
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP

# Allow access only from trusted internal subnets
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT

3. Log Audit & IoC Verification Commands

Inspect the web server access logs for suspicious requests targeting login.cgi with command injection payloads:

bash

# Search access logs for command injection patterns in the login.cgi request
grep -i 'login.cgi' /var/log/httpd/access_log | grep -E '(cli=|%3B|%26|%7C|cat|sh|wget|curl)'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

As this vulnerability is listed in CISA's KEV catalog, immediately restrict external access and upgrade the firmware to prevent active exploitation.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2016-20017) is an input validation bypass issue (CWE-77) residing in the login.cgi component of D-Link DSL-2750B wireless gateway devices. The root cause is the lack of sanitization and escaping of the user-supplied cli parameter before passing it directly to a system shell execution function.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can send a crafted HTTP POST or GET request targeting login.cgi. By appending shell metacharacters (such as ;, ` `, or |) into the cli` parameter, the attacker can break out of the intended command context and append arbitrary commands. This allows the execution of malicious payloads, such as downloading and running botnet malware, which has been actively observed in the wild from 2016 through 2022.

3. Infrastructure & Business Impact

Successful exploitation grants the attacker complete control over the router with root privileges. This can lead to lateral movement within the internal network, credential theft, DNS hijacking, and enlistment of the device into DDoS botnets (e.g., Mirai variants), causing severe operational disruption and reputational damage.

Official Vendor Advisories & References

NVD Original English Description

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

https://seclists.org/fulldisclosure/2016/Feb/53

Source: cve@mitre.org · Exploit, Mailing List, Third Party Advisory

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088

Source: cve@mitre.org · Patch, Vendor Advisory

https://www.exploit-db.com/exploits/44760

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

https://seclists.org/fulldisclosure/2016/Feb/53

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Mailing List, Third Party Advisory

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.exploit-db.com/exploits/44760

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

Frequently Asked SecOps Questions (CVE-2016-20017)

FAQ

Q1. How critical is CVE-2016-20017 and is it actively exploited in the wild?

CVE-2016-20017 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 65.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2016-20017?

Primary impacted vendors include d-link across dsl-2750b. Scope summary: All D-Link DSL-2750B devices running firmware versions prior to 1.05 (actively exploited in the wild)

Q3. What temporary mitigations or workarounds exist for CVE-2016-20017 before patching?

[Mitigation] Apply the official firmware patch (v1.05 or later) or immediately disable WAN-side access to the web management interface Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION