CVE-2016-20017

D-Link DSL-2750B routers running firmware before 1.05 contain an unauthenticated command injection flaw (CWE-77) in the 'cli' parameter of the login.cgi web endpoint. An attacker can trigger it remotely by sending a crafted HTTP request to login.cgi with shell metacharacters embedded in the cli parameter, requiring no credentials or user interaction. Successful exploitation yields arbitrary command execution on the router, giving the attacker full control of the device, which can be used for traffic interception, persistence, or recruitment into botnets such as the Mirai-based IZ1H9 campaign noted in recent reporting. Any internet-facing DSL-2750B running affected firmware is exposed, and CISA added the issue to the Known Exploited Vulnerabilities catalog on 2024-01-08 after exploitation observed in the wild from 2016 through 2022. With a CVSS of 9.8 and an EPSS of ~65%, exploitation pressure on unpatched devices remains high.

What to do: Upgrade DSL-2750B firmware to version 1.05 or later per vendor instructions; if an update is unavailable or the device is end-of-life, follow CISA's required action and discontinue use or restrict web (HTTP) management access to trusted networks only. Defenders should check device logs for suspicious unauthenticated requests to login.cgi containing shell metacharacters in the cli parameter, as these indicate exploitation attempts.