CVE-2019-16920

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.

• CWE-78
• CWE-78

• https://fortiguard.com/zeroday/FG-VD-19-117Broken Link, Third Party Advisory
• https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3Exploit, Third Party Advisory
• https://www.kb.cert.org/vuls/id/766427Third Party Advisory, US Government Resource
• https://www.seebug.org/vuldb/ssvid-98079Exploit, Third Party Advisory
• https://fortiguard.com/zeroday/FG-VD-19-117Broken Link, Third Party Advisory
• https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3Exploit, Third Party Advisory
• https://www.kb.cert.org/vuls/id/766427Third Party Advisory, US Government Resource
• https://www.seebug.org/vuldb/ssvid-98079Exploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16920US Government Resource

Published

Sep 27, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16914An XSS issue was discovered in pfSense through 2.4.4-p3. In …6.1
• CVE-2019-16915An issue was discovered in pfSense through 2.4.4-p3. widgets…9.8
• CVE-2019-16916Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-16917WiKID Enterprise 2FA (two factor authentication) Enterprise …8.8
• CVE-2019-16919Harbor API has a Broken Access Control vulnerability. The vu…7.5
• CVE-2019-1692A vulnerability in the web-based management interface of Cis…5.3
• CVE-2019-16921In the Linux kernel before 4.17, hns_roce_alloc_ucontext in …7.5
• CVE-2019-16922SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allo…5.3
• CVE-2019-16923kkcms 1.3 has jx.php?url= XSS.6.1
• CVE-2019-16924The Nulock application 1.5.0 for mobile devices sends a clea…8.8
• CVE-2019-16925Flower 0.9.3 has XSS via the name parameter in an @app.task …6.1
• CVE-2019-16926Flower 0.9.3 has XSS via a crafted worker name. NOTE: The pr…6.1