D-Link DWL-2600AP Firmware vulnerabilities

4 CVEs affecting D-Link DWL-2600AP Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-0127, published 2023-02-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-20500: D-Link DWL-2600AP Access Point Command Injection Vulnerability, published 2020-03-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-06-29. EPSS: 96.7% chance of exploitation in the next 30 days. D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the…
CVE-2019-20499, published 2020-03-05. High severity, CVSS 7.8. EPSS: 94.8% chance of exploitation in the next 30 days. D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the…
CVE-2019-20501, published 2020-03-05. High severity, CVSS 7.8. EPSS: 89.8% chance of exploitation in the next 30 days. D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface, using shell metacharacters in the…
CVE-2023-0127, published 2023-02-11. High severity, CVSS 7.8. EPSS: 2% chance of exploitation in the next 30 days. A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.