CVE-2019-20500

D-Link DWL-2600AP Access Point Command Injection Vulnerability

D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter. Vendor/Product: D-Link DWL-2600AP Access Point. Added to CISA KEV 2023-06-29; required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Category: Vulnerability, Known Exploited

Reference: NVD CVE-2019-20500