CVE-2019-16057

CVE-2019-16057 is a remote command injection flaw (CWE-78) in the login_mgr.cgi script of D-Link DNS-320 NAS firmware through version 2.05.B10. An attacker can trigger it by sending a crafted, unauthenticated HTTP request to login_mgr.cgi, causing injected operating-system commands to execute on the device. Successful exploitation yields full remote code execution on the NAS, giving the attacker control over stored data and a network foothold that can enable lateral movement or ransomware staging. Any D-Link DNS-320 running vulnerable firmware is affected, with directly internet-exposed units at greatest risk. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-15) with known ransomware use, a public proof-of-concept is available, and EPSS puts the 30-day exploitation probability at 87.1%.

What to do: Per CISA's required action, the DNS-320 is end-of-life and should be disconnected from the network if still in use, prioritizing any unit reachable from the internet. Check D-Link's support site for any final firmware release before retiring the device, and audit retained units for signs of compromise (unexpected processes or outbound connections) given known ransomware use.