CVE-2016-20017VulnerabilityPublished 01/08/2024Updated 10/24/2026
CVE-2016-20017: D-Link DSL-2750B Devices Command Injection Vulnerability
Affects D-Link DSL-2750B DevicesSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 01/08/2024
- KEV deadline
- 01/29/2024
- EPSS
- 66.6% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.