In August 13, 2019, D-Link becamea aware of a 3rd Party security researcher that accused the DNS-320 Hardware Rev. Ax of a remote command excution vulnerability in the web-GUI.
Prior to the report, on April 11, 2019, D-Link had published a security patch that addressed this issue and other reported vulnerabilities.
3rd Party Report:
Trung Nguyen :: trungnh _at_ cystack _dot_.net
- CVE-2019-16057 ::https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16057
- Public Disclosure: https://blog.cystack.net/d-link-dns-320-rce/
Affected Products and Fixes:
| Model |
Revision |
Affected FW |
Fixed FW |
Last Updated |
| DNS-320 |
All Ax revisions |
v2.05b10 and below (older) |
v2.06b01 |
09/15/2019
|
Regarding Security patch for your D-Link Devices
Firmware updates address the security vulnerabilities in affected D-Link devices. D-Link will update this continually and we strongly recommend all users to install the relevant updates.
Tto help better protect devices from security attacks, malware, and ransomware:
1.. Do not connect these devices directly to the Internet and/or port-forward services directly from the Internet.
2. Keep device firmware up-to-date.
3. Any computer accessing information on these devices should have appropriate anti-virus protection and malware protection enabled
4. Regular back-ups of stored information on these devices should occur in case a disaster recovery is needed.
As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the underside of the product next to the serial number. Alternatively, they can also be found on the device web configuration.