# CVE-2019-20500

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

- Page: https://www.vulneraibility.com/cve/CVE-2019-20500
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2023-06-29; CISA due date 2023-07-20
- EPSS: 96.71% (percentile 99.9)
- Public exploit code: 1 on Exploit-DB (first 2019-05-14)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-04)
- Weakness: CWE-78
- Published: 2020-03-05

## Affected

- dlink:dwl-2600ap_firmware

## References

- [other] https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113
- [other] https://www.exploit-db.com/exploits/46841
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-20500

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.