{"id":"CVE-2020-25506","published":"2021-02-02T13:15:12Z","modified":"2026-06-17T03:06:52Z","title":"D-Link DNS-320 Device Command Injection Vulnerability","vendor":"D-Link","product":"DNS-320 Device","tier":"core","eol":null,"description":{"text":"D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.","provenance":"source","from":"NVD"},"summary":{"text":"The D-Link DNS-320 device, firmware v2.06B01 Revision Ax, contains a command injection flaw in its system_mgr.cgi component, where special elements are not properly neutralised before being used in an OS command. An attacker with network access to the device can exploit this without authentication or user interaction to achieve remote arbitrary code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:43:56Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99968,"percentile":0.99977,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-25506","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-03-15","exploitedFirstSeen":"2021-03-15","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/","date":"2021-03-15"},{"url":"https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai","date":"2021-06-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities","date":"2022-12-06"},{"url":"https://blog.netlab.360.com/new-ddos-botnet-wszeor/","date":"2022-12-07"},{"url":"https://t.me/hacking_Attack/79492","date":"2022-12-08"},{"url":"https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":"2022-12-21"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/4926/new-zerobot-variant-exploits-additional-vulnerabilities-for-propagation","date":"2022-12-22"},{"url":"https://cujo.com/blog/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/","date":"2023-04-27"},{"url":"https://cujo.com/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/","date":"2023-04-27"}],"evidenceTotal":805,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675","tags":["Exploit","Third Party Advisory"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183","tags":["Vendor Advisory"]},{"url":"https://www.dlink.com/en/security-bulletin/","tags":["Vendor Advisory"]},{"url":"https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675","tags":["Exploit","Third Party Advisory"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183","tags":["Vendor Advisory"]},{"url":"https://www.dlink.com/en/security-bulletin/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25506","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.\n\n","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.\n\n","confidence":"high"},{"id":"T1584.005","name":"Botnet","tactics":["resource-development"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.\n\n","confidence":"high"}],"reports":[{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"CVE-2020-25506","start":12090,"end":12104},{"quote":"CVE-2020-25506","start":13299,"end":13313}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-18191","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18191","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2020-25506","name":"D-Link DNS-320 - Unauthenticated Remote Code Execution","severity":"critical","path":"http/cves/2020/CVE-2020-25506.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25506.yaml"}],"provenance":"source"},"exploitRefs":["https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1584.005"],"provenance":"source"}],"timeline":[{"date":"2021-02-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25506","provenance":"source"},{"date":"2021-03-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18191","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":274},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2056 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}