Log in Start free

Actively exploited · Published Dec 30, 2019 · Assigned by mitre

CVE-2019-17621

Critical 9.8 Exploited

In plain English

A critical-severity OS command injection in DIR-859 Router from D-Link. Attackers are actively exploiting it in the wild (listed by CISA on June 29, 2023). The chance it is exploited in the next 30 days is estimated at 90.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)90.6%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Jun 29, 2023
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Federal agencies must remediate by Jul 20, 2023.

Official description

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References