Support Announcements
DNS-320 :: H/W Rev. Ax :: F/W 2.05b10 and Lower (older) :: CVE-2019-16057 :: Remote Command Execution / RCE

 

In August 13, 2019, D-Link becamea aware of a 3rd Party security researcher that accused the DNS-320 Hardware Rev. Ax of a remote command excution vulnerability in the web-GUI.

 

Prior to the report, on April 11, 2019, D-Link had published a security patch that addressed this issue and other reported vulnerabilities. 

 

3rd Party Report:

 

 Trung Nguyen :: trungnh _at_ cystack _dot_.net

 

     - CVE-2019-16057 ::https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16057
     -
Public Disclosure: https://blog.cystack.net/d-link-dns-320-rce/

 

Affected Products and Fixes:

 

Model Revision Affected FW Fixed FW  Last Updated
DNS-320 All Ax revisions v2.05b10 and below (older) v2.06b01

09/15/2019

 

 

Regarding Security patch for your D-Link Devices
 
Firmware updates address the security vulnerabilities in affected D-Link devices. D-Link will update this continually and we strongly recommend all users to install the relevant updates.

 

Tto help better protect devices from security attacks, malware, and ransomware:

1.. Do not connect these devices directly to the Internet and/or port-forward services directly from the Internet.

2. Keep device firmware up-to-date.

3. Any computer accessing information on these devices should have appropriate anti-virus protection and malware protection enabled

4. Regular back-ups of stored information on these devices should occur in case a disaster recovery is needed.

 
As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the underside of the product next to the serial number. Alternatively, they can also be found on the device web configuration.