CVE-2019-17621
KEVD-Link DIR-859 Router Command Execution Vulnerability
Description
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedDec 30, 2019
Last modifiedJun 17, 2026
Added to KEVJun 29, 2023
Remediation dueJul 20, 2023
References
- packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.htmlExploitThird Party Advisory
- medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104ExploitThird Party Advisory
- medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9Broken Link
- supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146PatchVendor Advisory
- supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147PatchVendor Advisory
- dlink.com/en/security-bulletinVendor Advisory
- ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfThird Party AdvisoryUS Government Resource
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17621US Government Resource
0 recent articles mention this CVE
88
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1195 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 90.6% · top 1% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.