Vulnerability record

CVE-2019-16057

D-Link DNS-320 Remote Code Execution Vulnerability

CriticalExploitation confirmedCISA KEV Used by ransomware

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run DNS-320 Storage Device, fix it now.

CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

US federal civilian agencies must remediate by May 6, 2022.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Source
DNS-320 Storage Device	D-Link	KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog. Version details have not been published yet.

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2019-16057 scored CVSS 9.8: D-Link DNS-320 Storage Device, D-Link DNS-320 Remote Code Execution Vulnerability
CISA lists this as exploited in the wild and known to be used in ransomware campaigns. Unpatched DNS-320 Storage Device systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

We have not published a story about this vulnerability yet.

nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2019-16057
blog.cystack.net https://blog.cystack.net/d-link-dns-320-rce/
ftc.gov https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16057