{"id":"CVE-2016-20017","aliases":["EUVD-2016-3105","GHSA-4gf4-mg8f-6224"],"status":"published","title":"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login...","description":"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.65777,"percentile":0.99272,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2022-10-19T00:00:00Z","modified":"2026-06-17T00:43:05Z","kev":{"date_added":"2024-01-08","due_date":"2024-01-29","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-01-08"},{"source":"kev","since":"2024-01-08"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/dlink_dsl2750b_exec_noauth","title":"D-Link DSL-2750B OS Command Injection","type":"exploit","platform":"Linux","date":"2016-02-05","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/dlink_dsl2750b_exec_noauth"}],"products":[{"vendor":"d-link","product":"dsl-2750b devices"},{"vendor":"dlink","product":"dsl-2750b_firmware"}],"references":[{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://seclists.org/fulldisclosure/2016/Feb/53","tags":["x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44760","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-20017","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20017"},{"url":"https://github.com/advisories/GHSA-4gf4-mg8f-6224"}],"sources":{"cve":[{"id":"CVE-2016-20017","description":"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.","status":"published","published":"2022-10-19T00:00:00Z","modified":"2025-10-21T23:15:33.014Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:33:30.359814Z"}],"euvd":[{"id":"EUVD-2016-3105","description":"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.","status":"published","published":"2022-10-19T00:00:00Z","modified":"2025-10-21T23:15:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-01-08","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-4gf4-mg8f-6224","title":"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login...","description":"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.","status":"published","published":"2022-10-19T12:00:19Z","modified":"2025-10-22T00:32:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2016-20017","title":"D-Link DSL-2750B Devices Command Injection Vulnerability","description":"D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.","cwes":["CWE-77"],"kev":{"date_added":"2024-01-08","due_date":"2024-01-29","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2016-20017","description":"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.","status":"published","published":"2022-10-19T05:15:08.817Z","modified":"2026-06-17T00:43:05.853Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:03:40.811555Z"}]}}