CVE-2019-17621: D-Link DIR-859 Router Command Execution Vulnerability
First published: Mon Dec 30 2019(Updated: )
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dlink Dir-859 Firmware | <=1.05b03 | |
| Dlink Dir-859 Firmware | =1.06b01-beta1 | |
| Dlink Dir-859 | ||
| Dlink Dir-822 Firmware | <=2.03b01 | |
| Dlink Dir-822 | ||
| Dlink Dir-822 Firmware | <=3.12b04 | |
| Dlink Dir-823 Firmware | <=1.00b06 | |
| Dlink Dir-823 Firmware | =1.00b06-beta | |
| Dlink Dir-823 | ||
| Dlink Dir-865l Firmware | <=1.07b01 | |
| Dlink Dir-865l | ||
| Dlink Dir-868l Firmware | <=1.12b04 | |
| Dlink Dir-868l | ||
| Dlink Dir-868l Firmware | <=2.05b02 | |
| Dlink Dir-869 Firmware | <=1.03b02 | |
| Dlink Dir-869 Firmware | =1.03b02-beta02 | |
| Dlink Dir-869 | ||
| Dlink Dir-880l Firmware | <=1.08b04 | |
| Dlink Dir-880l | ||
| Dlink Dir-890l Firmware | <=1.11b01 | |
| Dlink Dir-890l Firmware | =1.11b01-beta01 | |
| Dlink Dir-890l | ||
| Dlink Dir-890r Firmware | <=1.11b01 | |
| Dlink Dir-890r Firmware | =1.11b01-beta01 | |
| Dlink Dir-890r | ||
| Dlink Dir-885l Firmware | <=1.12b05 | |
| Dlink Dir-885l | ||
| Dlink Dir-885r Firmware | <=1.12b05 | |
| Dlink Dir-885r | ||
| Dlink Dir-895l Firmware | <=1.12b10 | |
| Dlink Dir-895l | ||
| Dlink Dir-895r Firmware | <=1.12b10 | |
| Dlink Dir-895r | ||
| Dlink Dir-818lx Firmware | ||
| Dlink Dir-818lx | ||
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147
- http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html
- https://medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104
- https://medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
- https://www.dlink.com/en/security-bulletin
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
Frequently Asked Questions
What is CVE-2019-17621?
CVE-2019-17621 is a command execution vulnerability in the D-Link DIR-859 Router.
What is the severity of CVE-2019-17621?
CVE-2019-17621 has a severity rating of 9.8, which is considered critical.
How does the CVE-2019-17621 vulnerability affect D-Link DIR-859 Router?
The CVE-2019-17621 vulnerability allows an unauthenticated remote attacker to execute system commands as root on the D-Link DIR-859 Router.
Is D-Link DIR-859 Router the only affected software?
No, other versions of the D-Link firmware may also be affected by the CVE-2019-17621 vulnerability.
How can I fix the CVE-2019-17621 vulnerability?
To fix the CVE-2019-17621 vulnerability, you should update your D-Link DIR-859 Router firmware to the latest version available.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- collector/nvd-index
- vendor/d-link
- canonical/d-link dir-859 router
- vendor/dlink
- canonical/dlink dir-859 firmware
- version/dlink dir-859 firmware/1.05b03
- version/dlink dir-859 firmware/1.06b01-beta1
- canonical/dlink dir-859
- canonical/dlink dir-822 firmware
- version/dlink dir-822 firmware/2.03b01
- canonical/dlink dir-822
- version/dlink dir-822 firmware/3.12b04
- canonical/dlink dir-823 firmware
- version/dlink dir-823 firmware/1.00b06
- version/dlink dir-823 firmware/1.00b06-beta
- canonical/dlink dir-823
- canonical/dlink dir-865l firmware
- version/dlink dir-865l firmware/1.07b01
- canonical/dlink dir-865l
- canonical/dlink dir-868l firmware
- version/dlink dir-868l firmware/1.12b04
- canonical/dlink dir-868l
- version/dlink dir-868l firmware/2.05b02
- canonical/dlink dir-869 firmware
- version/dlink dir-869 firmware/1.03b02
- version/dlink dir-869 firmware/1.03b02-beta02
- canonical/dlink dir-869
- canonical/dlink dir-880l firmware
- version/dlink dir-880l firmware/1.08b04
- canonical/dlink dir-880l
- canonical/dlink dir-890l firmware
- version/dlink dir-890l firmware/1.11b01
- version/dlink dir-890l firmware/1.11b01-beta01
- canonical/dlink dir-890l
- canonical/dlink dir-890r firmware
- version/dlink dir-890r firmware/1.11b01
- version/dlink dir-890r firmware/1.11b01-beta01
- canonical/dlink dir-890r
- canonical/dlink dir-885l firmware
- version/dlink dir-885l firmware/1.12b05
- canonical/dlink dir-885l
- canonical/dlink dir-885r firmware
- version/dlink dir-885r firmware/1.12b05
- canonical/dlink dir-885r
- canonical/dlink dir-895l firmware
- version/dlink dir-895l firmware/1.12b10
- canonical/dlink dir-895l
- canonical/dlink dir-895r firmware
- version/dlink dir-895r firmware/1.12b10
- canonical/dlink dir-895r
- canonical/dlink dir-818lx firmware
- canonical/dlink dir-818lx