CVE-2016-20017

This is a serious weakness in certain D-Link DSL-2750B routers that lets an attacker type commands into the device over the network, without needing a username or password.

Think of the router’s “login screen” having a hidden back door: instead of logging in normally, an attacker can send a special request that makes the router run their commands—leading to takeover, traffic being rerouted, or the internet connection being knocked offline.

This matters if you use or manage a D-Link DSL-2750B router that is running firmware older than 1.05.

Because the issue does not require authentication or user interaction, it becomes a real risk when an attacker can reach the router’s web interface from the network (for example, exposed to the internet) using the vulnerable endpoint.

This is RED because attackers can execute commands remotely without authentication, and the vulnerability is listed in CISA’s KEV (meaning it’s been actively targeted in real environments).

The CISA-required remediation due date was 2024-01-29, so you should treat this as already past-due if the device is still in use and not updated to 1.05+.