CVE-2020-25506

dlink dns-320 firmware

Published 2 Feb 2021 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 3 May 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.

References

gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675 · Exploit, Third Party Advisory
supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183 · Vendor Advisory
www.dlink.com/en/security-bulletin/ · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25506 · US Government Resource