A pair of remote code execution (RCE) vulnerabilities rated at the maximum CVSS 10.0 have been confirmed in legacy D-Link routers. These flaws can be exploited without any authentication, allowing attackers to run arbitrary commands and potentially seize full control of affected devices. Unlike some high-severity bugs that require user interaction or other prerequisites, this makes these vulnerabilities especially dangerous.
What’s Affected and How it Works
The bugs, catalogued under CVE-2019-16920, impact several D-Link Wi-Fi router models, including the DIR-655, DIR-866L, DIR-652, and DHP-1565. The vulnerabilities stem from command-injection errors in firmware where user inputs are improperly sanitized. In practice, this means an attacker on the network can send crafted requests to endpoints on the device and execute system-level commands as root. No login or privileged access is required. The vulnerabilities were discovered and documented by Fortinet’s FortiGuard Labs. The firmware versions affected are the latest ones deployed at the time of the discovery. There has been no indication that future firmware fixes are available for these models.
Threat Landscape & Severity
The CVSS 10.0 rating reflects the combination of several critical factors: these are remote exploits over the network (AV:N), low complexity (AC:L), no prerequisites like credentials or user interaction (Au:N), and full impact on confidentiality, integrity, and availability (C:I:A:C). That means attackers gain full system access, can steal or delete data, disrupt service, or turn the router into a launchpad for further attacks.
Given that the affected routers are end-of-life (EOL), there is little hope for vendor patching or support. Users who still rely on these devices are essentially exposed permanently unless mitigation or replacement is undertaken. This situation has echoes of other vulnerabilities in EOL DSL gateways, such as CVE-2026-0625, which similarly allowed unauthenticated remote command execution on models like the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B.
What You Can Do
- Identify whether you own one of the affected models (DIR-655, DIR-866L, DIR-652, DHP-1565).
- If possible, disconnect the devices from external access and disable remote administration features.
- Replace these routers with models receiving active security updates.
- Use strong segmentation and firewalls to reduce exposure to compromised routers on your network.
Given that no patch is available and the manufacturer has declared them beyond support, continued use of these routers carries substantial risk. In short, these are unsafe past their prime.
These vulnerabilities drive home a broader, sobering point about router security: when support ends, so does your layer of defense. With CVSS 10.0 flaws that don’t need authentication, exploitability becomes instantaneous and widespread. Users relying on end-of-life hardware must prioritize timely replacement. As IoT and network perimeter devices continue to play central roles in both home and enterprise settings, maintaining up-to-date firmware and retiring unsupported gear isn’t optional—it’s critical.
