D-Link DNS-320 Device Command Injection Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2020-25506 · Published 02/02/2021 · updated 17/06/2026

D-Link DNS-320 Device Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

In short

CVE-2020-25506 is a CRITICAL (CVSS 9.8) vulnerability.
Exploited in the wild: CISA added it to the KEV catalog on 03/11/2021.
Chance of exploitation in the next 30 days (EPSS): 100.0%, higher than 100.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
DNS-320 Device D-Link	Versions not published yet (product named by CISA KEV)

Description

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.

References

gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675 · Exploit
supportannouncement.us.dlink.com/announcement/publication.aspx · Vendor Advisory
dlink.com/en/security-bulletin · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-25506

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free