CVE-2016-20017

This is a serious weakness in certain D-Link DSL-2750B routers that lets an attacker type commands into the device over the network, without needing a username or password.

Think of the router’s “login screen” having a hidden back door: instead of logging in normally, an attacker can send a special request that makes the router run their commands—leading to takeover, traffic being rerouted, or the internet connection being knocked offline.

This matters if you use or manage a D-Link DSL-2750B router that is running firmware older than 1.05.

Because the issue does not require authentication or user interaction, it becomes a real risk when an attacker can reach the router’s web interface from the network (for example, exposed to the internet) using the vulnerable endpoint.

This is RED because attackers can execute commands remotely without authentication, and the vulnerability is listed in CISA’s KEV (meaning it’s been actively targeted in real environments).

The CISA-required remediation due date was 2024-01-29, so you should treat this as already past-due if the device is still in use and not updated to 1.05+.

1. Confirm exposure on your side

   • Identify every D-Link DSL-2750B in use (including ones provided by staff/contractors).
   • For each device, check the firmware version. If it’s “before 1.05,” you are affected.

2. Apply the fixed version

   • Upgrade the DSL-2750B firmware to 1.05 or newer.
   • Use the device’s built-in update process or the vendor’s official firmware package.
   • After upgrade, reboot the router and confirm the firmware version now shows 1.05+.

3. If you cannot upgrade

   • Discontinue use of the affected DSL-2750B model.
   • Replace it with a supported router/firmware that is not vulnerable.

4. Reduce reachability while you remediate

   • Ensure the router’s management interface is not exposed to the public internet.
   • Restrict management access to trusted local networks/VPN only, if supported.

5. Check for signs of attempted abuse (after mitigation)

   • Review router logs for unusual requests to web/login-related endpoints.
   • Look for unexpected configuration changes, loss of connectivity, or new admin accounts/rules.

6. Timing

   • This vulnerability is in CISA KEV; CISA’s remediation due date was 2024-01-29. If any DSL-2750B is still on firmware before 1.05, complete the upgrade/replace as a top priority immediately.

CVE-2016-20017 affects D-Link DSL-2750B firmware versions before 1.05. The weakness is CWE-77 (command injection), reachable over the network.

Mechanism: a crafted request sent to the web endpoint login.cgi using the cli parameter can cause remote command execution without authentication and without user interaction.

Exploitation status: listed in CISA KEV (added 2024-01-08) with a remediation due date of 2024-01-29, indicating confirmed real-world exploitation.

Patch: fixed in “1.05” per the vendor’s remediation information.

Exploit maturity: public exploit availability is noted (at least one known), which increases the likelihood of rapid abuse if a device is reachable.