CVE-2019-20499: D-Link DWL-2600AP authenticated OS command injection in config restore

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityAuthenticated command injection with public exploit code and very high EPSS, though exploitation requires valid admin credentials and access to the management interface.

What it is

D-Link DWL-2600AP firmware 4.2.0.15 Rev A fails to sanitize the configRestore and configServerip parameters in the admin.cgi config_restore action, allowing shell metacharacters to reach the OS. An authenticated administrator can inject commands through the Restore Configuration web function, turning a routine management feature into remote code execution on the device.

Impact

An attacker with valid admin credentials gains arbitrary command execution as the device's web service account, enabling full compromise of confidentiality, integrity and availability of the access point.

Attack surface

Reached through the web management interface's Restore Configuration functionality via the admin.cgi config_restore action; authentication as an administrator is required and no user interaction beyond submitting the request is needed. The CVSS vector AV:L reflects the local/adjacent nature of the management interface rather than internet exposure.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (46841) and Packet Storm advisory exist, and EPSS is 0.95348 (99.864th percentile), indicating high predicted exploitation activity.

What to do

• Apply the D-Link vendor advisory SAP10113 firmware fix for DWL-2600AP 4.2.0.15 Rev A.
• If patching is not immediately possible, disable or restrict access to the web management interface and the Restore Configuration feature.
• Segment management interfaces on a dedicated VLAN and block access from untrusted networks.
• Change default and weak admin credentials and enforce strong unique passwords for device administration.
• Monitor D-Link for a superseding advisory if the listed firmware remains affected.

Detection

• Review web server and device logs for requests to admin.cgi with action=config_restore containing shell metacharacters in configRestore or configServerip.
• Alert on unexpected child processes or shell execution spawned by the device's web management service.
• Monitor for outbound connections or file changes on the access point following configuration restore operations.
• Audit administrator account usage and authentication events for the web interface on DWL-2600AP devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.