D-Link · DSL-2750B Devices

CVE-2016-20017

D-Link DSL-2750B Devices Command Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 66%

What it is

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

CISA: D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: January 29, 2024

Added to the CISA list: January 8, 2024
Published: October 19, 2022
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 66% in the top 0.7% of all known vulnerabilities
Weakness: CWE-77
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from D-Link

Added	Vulnerability	Product	Severity	Attack chance
Apr 24, 2026	Command InjectionCVE-2025-29635	DIR-823X	High 7.2	88%
Dec 8, 2025	Buffer OverflowCVE-2022-37055	Routers	Critical 9.8	56%
Aug 5, 2025	UnspecifiedCVE-2020-25078	DCS-2530L and DCS-2670L Devices	High 7.5	98%
Aug 5, 2025	DCS-2530L and DCS-2670L Command InjectionCVE-2020-25079	DCS-2530L and DCS-2670L Devices	High 8.8	54%
Aug 5, 2025	Download of Code Without Integrity CheckCVE-2022-40799	DNR-322L	High 8.8	34%
Jun 25, 2025	D-Link DIR-859 Router Path TraversalCVE-2024-0769	DIR-859 Router	Medium 5.3	83%
Sep 30, 2024	OS Command InjectionCVE-2023-25280	DIR-820 Router	Critical 9.8	98%
May 16, 2024	Information DisclosureCVE-2021-40655	DIR-605 Router	High 7.5	87%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.