CVE-2019-16920: D-Link router PingTest CGI command injection allows unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with CVSS 9.8, confirmed exploitation in CISA KEV, and no vendor patch because the products are end-of-life.

What it is

Multiple D-Link router and powerline models expose a PingTest common gateway interface that passes arbitrary input into a system command without sanitization, resulting in OS command injection. Because the endpoint is reachable without authentication, an attacker on the network can execute commands as the device's web service user. The affected products are end-of-life, so no vendor fix is expected.

Impact

An attacker gains remote code execution on the device, leading to full system compromise of the router. That provides a foothold for traffic interception, credential capture, and use of the device as a pivot into the internal network.

Attack surface

Reached over the network via the device's web management interface, specifically the PingTest CGI endpoint. The CVSS vector shows PR:N and UI:N, so no authentication and no user interaction are required.

Exploitation

CVE-2019-16920 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25) and has an EPSS 30-day probability of 0.99996, with public exploit references tagged on the record. No ransomware campaign use is documented.

What to do

• Retire or replace the affected end-of-life D-Link models; CISA's required action is to disconnect them if still in use.
• If a device cannot be removed immediately, isolate it on a dedicated network segment with no access to management interfaces from untrusted networks.
• Block external and lateral access to the router web management interface and the PingTest CGI endpoint at the firewall.
• Disable remote administration and UPnP on these devices, and change default administrative credentials.
• Monitor for and remove any of the listed models still present on the network inventory.

Detection

• Inspect web server or proxy logs for requests to the PingTest CGI path containing shell metacharacters such as semicolons, pipes, backticks, or command substitution.
• Alert on outbound connections from router management IPs to unusual destinations or ports, which may indicate command execution and callback.
• Watch for unexpected processes or configuration changes on the device, such as new admin accounts or altered DNS settings.
• Scan the network for the affected D-Link models and flag any that remain reachable on management interfaces.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.