CVE-2020-25506
KEVD-Link DNS-320 Device Command Injection Vulnerability
Description
D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedFeb 2, 2021
Last modifiedJun 17, 2026
Added to KEVNov 3, 2021
Remediation dueMay 3, 2022
References
- gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675ExploitThird Party Advisory
- supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183Vendor Advisory
- dlink.com/en/security-bulletin/Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25506US Government Resource
0 recent articles mention this CVE
89
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1638 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 100.0% · top 1% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.