CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Published: Dec 30, 2019
Updated: Apr 13, 2023
CVE: CVE-2019-17621
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 10
AV:N/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-78

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
dlink / dir-859_firmware	-	1.05b03.x
dlink / dir-859_firmware	1.06b01-beta1	1.06b01-beta1.x
dlink / dir-822_firmware	-	2.03b01.x
dlink / dir-822_firmware	-	3.12b04.x
dlink / dir-823_firmware	-	1.00b06.x
dlink / dir-823_firmware	1.00b06-beta	1.00b06-beta.x
dlink / dir-865l_firmware	-	1.07b01.x
dlink / dir-868l_firmware	-	1.12b04.x
dlink / dir-868l_firmware	-	2.05b02.x
dlink / dir-869_firmware	-	1.03b02.x
dlink / dir-869_firmware	1.03b02-beta02	1.03b02-beta02.x
dlink / dir-880l_firmware	-	1.08b04.x
dlink / dir-890l_firmware	-	1.11b01.x
dlink / dir-890l_firmware	1.11b01-beta01	1.11b01-beta01.x
dlink / dir-890r_firmware	-	1.11b01.x
dlink / dir-890r_firmware	1.11b01-beta01	1.11b01-beta01.x
dlink / dir-885l_firmware	-	1.12b05.x
dlink / dir-885r_firmware	-	1.12b05.x
dlink / dir-895l_firmware	-	1.12b10.x
dlink / dir-895r_firmware	-	1.12b10.x

Vulnerability Database

CVE-2019-17621

Deep Security Visibility Without the Complexity