D-Link DWL-2600AP Access Point Command Injection Vulnerability
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
- Vendor
- D-Link
- Product
- DWL-2600AP Access Point
- CVSS
- 7.8
- EPSS (exploit probability)
- 96.7%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Added to KEV
Is CVE-2019-20500 being exploited?
Yes. CISA added CVE-2019-20500 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 96.7% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-24. Full cross-catalog view: /kev-comparison
CVE-2019-20500 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
CISA required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Other D-Link CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-86296 D-Link DIR-822A Maximum Severity Zero-Day Vulnerabilitywrite-up | [ CRITICAL ] | 10.0 | 1.7% | — |
| CVE-2026-90703 D-Link DWR-M921 command injection via disk share creation endpointwrite-up | [ CRITICAL ] | 9.1 | 3.6% | — |
| CVE-2026-90702 D-Link DWR-M921 command injection via disk format endpointwrite-up | [ CRITICAL ] | 9.1 | 3.6% | — |
| CVE-2026-90699 D-Link DWR-M920 command injection via SIM PIN management endpointwrite-up | [ CRITICAL ] | 9.9 | 3.3% | — |
| CVE-2025-29635 D-Link DIR-823X Command Injection Vulnerability | [ HIGH ] | 7.2 | 87.9% | |
| CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 55.5% | |
| CVE-2022-40799 D-Link DNR-322L Download of Code Without Integrity Check Vulnerability | [ HIGH ] | 8.8 | 33.7% | |
| CVE-2020-25079 D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability | [ HIGH ] | 8.8 | 54.0% |