Remote Command Injection (CVE‑2016‑20017) in D‑Link DSL‑2750B Routers Allows Unauthenticated OS Command Execution
What It Is – D‑Link DSL‑2750B broadband routers contain a command‑injection flaw in the login.cgi endpoint. An attacker can send a crafted cli parameter and execute arbitrary operating‑system commands on the device without any authentication.
Exploitability – The vulnerability is publicly disclosed, has an assigned CVSS v3.1 score of 7.8 (High), and no public exploit code is required; a simple HTTP request is sufficient.
Affected Products – D‑Link DSL‑2750B residential/SMB router (all firmware releases prior to the vendor’s security patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous asset inventory and firmware version tracking as evidence of due‑diligence.
- Highlights gaps in configuration‑management controls; without verified patch status, auditors cannot attest to a defended network perimeter.
- Remote code execution on a network edge device can undermine logging and incident‑response evidence, eroding the audit trail that regulators expect.
Recommended Actions
- Identify every DSL‑2750B unit in your environment via network scans or CMDB reconciliation.
- Verify firmware versions against D‑Link’s advisory; apply the vendor‑released patch or upgrade to a non‑vulnerable model.
- Segment the routers on a dedicated VLAN and enforce strict inbound firewall rules to limit exposure.
- Enable and centralize system logs (syslog, SNMP traps) to detect anomalous command‑injection attempts.
- Document the remediation steps in your control evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2016‑20017