CVE-2019-17621
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - cve@mitre.org
- Published
- 2019-12-30
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2023-06-29, action due 2023-07-20: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- Weaknesses
- CWE-78
Affected products
- Dir-818lx Firmware (Dlink)
- Dir-822 Firmware (Dlink)
- Dir-823 Firmware (Dlink)
- Dir-859 Firmware (Dlink)
- Dir-865l Firmware (Dlink)
- Dir-868l Firmware (Dlink)
- Dir-869 Firmware (Dlink)
- Dir-880l Firmware (Dlink)
- Dir-885l Firmware (Dlink)
- Dir-885r Firmware (Dlink)
- Dir-890l Firmware (Dlink)
- Dir-890r Firmware (Dlink)
- Dir-895l Firmware (Dlink)
- Dir-895r Firmware (Dlink)
References
- http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html
- https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104
- https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147
- https://www.dlink.com/en/security-bulletin
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17621
