Back to CVE Browser

CVE-2016-20017

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score51.7550%

EPSS Percentile90.70th

Published2022-10-19

Last Modified2026-06-17

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

Affected Platforms (CPE)

💻

Dlink

Dsl 2750b Firmware

< 1.05

References & Advisories

🔗 https://seclists.org/fulldisclosure/2016/Feb/53

🔗 https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088

🔗 https://www.exploit-db.com/exploits/44760

🔗 https://seclists.org/fulldisclosure/2016/Feb/53

🔗 https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088

🔗 https://www.exploit-db.com/exploits/44760

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-20017

Related Vulnerabilities

CVE-2026-167718.8

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-b...

CVE-2026-120015.2

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6...

CVE-2026-658937.0

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with ...

CVE-2026-645208.4

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The ...