D-Link · DNS-320 Storage Device

CVE-2019-16057

D-Link DNS-320 Remote Code Execution Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 86%

What it is

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

CISA: The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.

What to do

The impacted product is end-of-life and should be disconnected if still in use.

Deadline for US federal agencies: May 6, 2022

Added to the CISA list: April 15, 2022
Published: September 16, 2019
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 86% in the top 0.3% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from D-Link

Added	Vulnerability	Product	Severity	Attack chance
Apr 24, 2026	Command InjectionCVE-2025-29635	DIR-823X	High 7.2	88%
Dec 8, 2025	Buffer OverflowCVE-2022-37055	Routers	Critical 9.8	56%
Aug 5, 2025	UnspecifiedCVE-2020-25078	DCS-2530L and DCS-2670L Devices	High 7.5	98%
Aug 5, 2025	DCS-2530L and DCS-2670L Command InjectionCVE-2020-25079	DCS-2530L and DCS-2670L Devices	High 8.8	54%
Aug 5, 2025	Download of Code Without Integrity CheckCVE-2022-40799	DNR-322L	High 8.8	34%
Jun 25, 2025	D-Link DIR-859 Router Path TraversalCVE-2024-0769	DIR-859 Router	Medium 5.3	83%
Sep 30, 2024	OS Command InjectionCVE-2023-25280	DIR-820 Router	Critical 9.8	98%
May 16, 2024	Information DisclosureCVE-2021-40655	DIR-605 Router	High 7.5	87%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.