Evil-DB LogoEvil-DB
← All CVEs

CVE-2019-17621

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Added 2023-06-29Remediation due 2023-07-20

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

9.8
CVSS
89.6%
EPSS (exploit prob.)
100th
EPSS percentile
2019-12-30
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

VendorProductAffected versions
dlinkdir-859_firmware<= 1.05b03
dlinkdir-859_firmware1.06b01
dlinkdir-859all versions
dlinkdir-822_firmware<= 2.03b01
dlinkdir-822all versions
dlinkdir-822_firmware<= 3.12b04
dlinkdir-822all versions
dlinkdir-823_firmware<= 1.00b06
dlinkdir-823_firmware1.00b06
dlinkdir-823all versions
dlinkdir-865l_firmware<= 1.07b01
dlinkdir-865lall versions
dlinkdir-868l_firmware<= 1.12b04
dlinkdir-868lall versions
dlinkdir-868l_firmware<= 2.05b02
dlinkdir-868lall versions
dlinkdir-869_firmware<= 1.03b02
dlinkdir-869_firmware1.03b02
dlinkdir-869all versions
dlinkdir-880l_firmware<= 1.08b04
dlinkdir-880lall versions
dlinkdir-890l_firmware<= 1.11b01
dlinkdir-890l_firmware1.11b01
dlinkdir-890lall versions
dlinkdir-890r_firmware<= 1.11b01
dlinkdir-890r_firmware1.11b01
dlinkdir-890rall versions
dlinkdir-885l_firmware<= 1.12b05
dlinkdir-885lall versions
dlinkdir-885r_firmware<= 1.12b05
dlinkdir-885rall versions
dlinkdir-895l_firmware<= 1.12b10
dlinkdir-895lall versions
dlinkdir-895r_firmware<= 1.12b10
dlinkdir-895rall versions
dlinkdir-818lx_firmwareall versions
dlinkdir-818lxall versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-17621