Actively exploited in the wild

D-Link DIR-859 Router Path Traversal Vulnerability

D-Link - DIR-859 Router · Listed in the CISA KEV since 2025-06-25. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2024-0769

MediumCVSS 5.3KEV

Published: 21/01/2024(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A critical path traversal vulnerability exists in D-Link DIR-859 1.06B01 in the /hedwig.cgi file of the HTTP POST Request Handler. Manipulation of the 'service' argument allows remote attack, and the exploit has been publicly disclosed.

Risk Assessment

An attacker could access files outside the intended directory, potentially leading to disclosure of sensitive information or further compromise of the device.

Recommendation

The product is end-of-life and will not receive patches. Replace the device with a newer, supported model as soon as possible.

Other vulnerabilities in D-Link DIR-859

CVE-2019-17621CriticalActively exploited
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Original NVD description (English source)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.