CVE-2020-25506: D-Link DNS-320 system_mgr.cgi command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe vulnerability is remotely exploitable without authentication, has a CVSS score of 9.8, is in CISA KEV, and has an extremely high EPSS score, indicating active exploitation and severe impact.

What it is

D-Link DNS-320 firmware v2.06B01 Revision Ax contains an OS command injection flaw in the system_mgr.cgi component, allowing remote arbitrary code execution. The vulnerability is network-reachable and requires no authentication or user interaction, making it a severe risk for exposed devices.

Impact

An unauthenticated remote attacker can execute arbitrary commands on the device, gaining full control over its confidentiality, integrity, and availability. This could enable data theft, device reconfiguration, or use as a pivot point into the network.

Attack surface

The flaw is reached over the network via the system_mgr.cgi web interface, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet- or LAN-exposed D-Link DNS-320 running the affected firmware is potentially vulnerable.

Exploitation

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and has an EPSS probability of 0.99968 (99.9th percentile), indicating active exploitation is highly likely. Public exploit code is referenced in third-party advisories.

What to do

• Apply the vendor firmware update per D-Link security advisory SAP10183 immediately.
• If patching is not possible, isolate affected devices from untrusted networks and disable remote management access.
• Restrict access to the system_mgr.cgi interface using firewall rules or network segmentation.
• Monitor D-Link security bulletins for further updates or end-of-life guidance.
• Consider replacing end-of-life devices that no longer receive security updates.

Detection

• Monitor web server logs for unusual requests to system_mgr.cgi, especially those containing shell metacharacters or command strings.
• Inspect network traffic for outbound connections from D-Link DNS-320 devices to unexpected external hosts.
• Use endpoint or network detection to flag command execution attempts or anomalous process creation on the device if telemetry is available.
• Check for signs of unauthorized configuration changes or persistence mechanisms on the device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.