CVE-2019-20500

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

• CWE-78
• CWE-78

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113Patch, Vendor Advisory
• https://www.exploit-db.com/exploits/46841Exploit, Third Party Advisory, VDB Entry
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113Patch, Vendor Advisory
• https://www.exploit-db.com/exploits/46841Exploit, Third Party Advisory, VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-20500US Government Resource

Published

Mar 5, 2020

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20495cPanel before 82.0.18 allows attackers to read an arbitrary …6.5
• CVE-2019-20496cPanel before 82.0.18 allows attackers to conduct arbitrary …5.5
• CVE-2019-20497cPanel before 82.0.18 allows stored XSS via WHM Backup Resto…5.4
• CVE-2019-20498cPanel before 82.0.18 allows WebDAV authentication bypass be…9.8
• CVE-2019-20499D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticat…7.8
• CVE-2019-2050In tearDownClientInterface of WificondControl.java, there is…
• CVE-2019-20501D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticat…7.8
• CVE-2019-20502An issue was discovered in EFS Easy Chat Server 3.1. There i…7.5
• CVE-2019-20503usrsctp before 2019-12-20 has out-of-bounds reads in sctp_lo…6.5
• CVE-2019-20504service/krashrpt.php in Quest KACE K1000 Systems Management …9.8
• CVE-2019-20509Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-2051In heap of spaces.h, there is a possible out of bounds read …