Actively exploited in the wild

D-Link DIR-859 Router Command Execution Vulnerability

D-Link - DIR-859 Router · Listed in the CISA KEV since 2023-06-29. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

CVE-2019-17621

CriticalCVSS 9.8KEV

Published: 30/12/2019(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Risk Assessment

Critical risk of full router takeover by an attacker on the local network, potentially leading to further attacks on the internal network.

Recommendation

Update the D-Link DIR-859 router firmware to the latest version or disable UPnP if not required.

Other vulnerabilities in D-Link DIR-859

CVE-2024-0769MediumActively exploited
A critical path traversal vulnerability exists in D-Link DIR-859 1.06B01 in the /hedwig.cgi file of the HTTP POST Request Handler. Manipulation of the 'service' argument allows remote attack, and the exploit has been publicly disclosed.

Original NVD description (English source)

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS