CVE DatabaseCVE-2019-16057

Updated 2026-06-17한국어 권고문 →

CVE-2019-160579.8/CRITICALCISA KEVCWE-78CWE-78

D-Link ShareCenter DNS-320 login_mgr.cgi Remote Command Injection (RCE) Vulnerability (CVE-2019-16057) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

d-link

Affected Components

dns-320

Published Date

2019-09-16

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

86.5%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

D-Link ShareCenter DNS-320 NAS devices running firmware versions up to and including 2.05.B10

Impact

Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests.

Mitigation

Immediately restrict external internet access to the device and replace the legacy/EoL hardware with a supported model.

Affected Products & Version Scope

D-Link ShareCenter DNS-320 (All firmware versions up to and including 2.05.B10)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Since this product is End-of-Life (EoL), official security patches may not be available. If a patch is provided, apply it immediately. Below are commands to verify the system status after any maintenance.

bash

# Check current system and firmware details
uname -a
cat /etc/issue

# Verify if web services are running on expected ports
netstat -antp | grep -E '80|443'

2. Temporary Workaround & Hardening Configuration

If immediate replacement is not feasible, isolate the device from the public internet and restrict access to trusted internal IP ranges only.

bash

# Block external WAN access to web administration ports using iptables
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

3. Log Audit & IoC Verification Commands

Audit the web server logs to detect potential exploitation attempts targeting the 'login_mgr.cgi' script.

bash

# Scan web access logs for suspicious characters in requests to login_mgr.cgi
grep 'login_mgr.cgi' /var/log/lighttpd/access.log | grep -E '(%3B|%7C|%60|%26|;|\||`|&)'

# Monitor active processes for unauthorized shell executions
ps aux | grep -E '(sh|bash|ash) -c'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to the EoL status of the D-Link DNS-320, it is highly recommended to decommission the device and migrate to a modern, actively supported storage solution.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2019-16057) exists in the 'login_mgr.cgi' script of the D-Link DNS-320 NAS web management interface. Due to insufficient input validation and sanitization of user-supplied parameters, the application directly passes input containing shell metacharacters to the system shell, leading to an OS Command Injection vulnerability (CWE-78).

2. Exploitation Mechanics & Attack Scenario

An attacker can access the 'login_mgr.cgi' endpoint without prior authentication. By embedding shell command separators (such as semicolons, backticks, or pipes) within vulnerable parameters, the attacker forces the underlying web server to execute arbitrary commands under the context of the root user. This allows for complete system compromise, including establishing reverse shells or downloading malicious payloads.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability is actively exploited in the wild by botnets and ransomware operators. Successful exploitation allows attackers to gain full control of the NAS, leading to data exfiltration, ransomware deployment, and potential lateral movement within the internal network.

Official Vendor Advisories & References

NVD Original English Description

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

https://blog.cystack.net/d-link-dns-320-rce/

Source: cve@mitre.org · Exploit, Third Party Advisory

https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf

Source: cve@mitre.org · Third Party Advisory, US Government Resource

https://blog.cystack.net/d-link-dns-320-rce/

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory

https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory, US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16057

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2019-16057)

FAQ

Q1. How critical is CVE-2019-16057 and is it actively exploited in the wild?

CVE-2019-16057 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 86.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2019-16057?

Primary impacted vendors include d-link across dns-320. Scope summary: D-Link ShareCenter DNS-320 (All firmware versions up to and including 2.05.B10)

Q3. What temporary mitigations or workarounds exist for CVE-2019-16057 before patching?

[Mitigation] Immediately restrict external internet access to the device and replace the legacy/EoL hardware with a supported model. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION