Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2019-17621 Details

Description

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17621	CISA-ADP	US Government Resource
http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html	CVE	ExploitThird Party AdvisoryVDB Entry
https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104	CVE	ExploitThird Party Advisory
https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9	CVE	Broken Link
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146	CVE	PatchVendor Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147	CVE	PatchVendor Advisory
https://www.dlink.com/en/security-bulletin	CVE	Vendor Advisory
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf	CVE	Third Party AdvisoryUS Government Resource
http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html	[email protected]	ExploitThird Party AdvisoryVDB Entry
https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104	[email protected]	ExploitThird Party Advisory
https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9	[email protected]	Broken Link
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146	[email protected]	PatchVendor Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147	[email protected]	PatchVendor Advisory
https://www.dlink.com/en/security-bulletin	[email protected]	Vendor Advisory
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf	[email protected]	Third Party AdvisoryUS Government Resource

see all 15 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name	Date Added	Due Date	Required Action
D-Link DIR-859 Router Command Execution Vulnerability	Jun 29, 2023	Jul 20, 2023	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	[email protected]
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	CISA-ADP

Affected Products

Product	Versions
dlink dir-859 firmware	<= 1.05b03 1.06b01 beta1
CPE cpe:2.3:o:dlink:dir-859_firmware:::::::: cpe:2.3:o:dlink:dir-859_firmware:1.06b01:beta1:::::: Remediation No remediation found in references.
dlink dir-859	All versions
CPE cpe:2.3:h:dlink:dir-859:-:::::::* Remediation No remediation found in references.
dlink dir-822 firmware	<= 2.03b01 <= 3.12b04
CPE cpe:2.3:o:dlink:dir-822_firmware:::::::: Remediation No remediation found in references.
dlink dir-822	All versions
CPE cpe:2.3:h:dlink:dir-822:-:::::::* Remediation No remediation found in references.
dlink dir-823 firmware	<= 1.00b06 1.00b06 beta
CPE cpe:2.3:o:dlink:dir-823_firmware:::::::: cpe:2.3:o:dlink:dir-823_firmware:1.00b06:beta:::::: Remediation No remediation found in references.
dlink dir-823	All versions
CPE cpe:2.3:h:dlink:dir-823:-:::::::* Remediation No remediation found in references.
dlink dir-865l firmware	<= 1.07b01
CPE cpe:2.3:o:dlink:dir-865l_firmware:::::::: Remediation No remediation found in references.
dlink dir-865l	All versions
CPE cpe:2.3:h:dlink:dir-865l:-:::::::* Remediation No remediation found in references.
dlink dir-868l firmware	<= 1.12b04 <= 2.05b02
CPE cpe:2.3:o:dlink:dir-868l_firmware:::::::: Remediation No remediation found in references.
dlink dir-868l	All versions
CPE cpe:2.3:h:dlink:dir-868l:-:::::::* Remediation No remediation found in references.
dlink dir-869 firmware	<= 1.03b02 1.03b02 beta02
CPE cpe:2.3:o:dlink:dir-869_firmware:::::::: cpe:2.3:o:dlink:dir-869_firmware:1.03b02:beta02:::::: Remediation No remediation found in references.
dlink dir-869	All versions
CPE cpe:2.3:h:dlink:dir-869:-:::::::* Remediation No remediation found in references.
dlink dir-880l firmware	<= 1.08b04
CPE cpe:2.3:o:dlink:dir-880l_firmware:::::::: Remediation No remediation found in references.
dlink dir-880l	All versions
CPE cpe:2.3:h:dlink:dir-880l:-:::::::* Remediation No remediation found in references.
dlink dir-890l firmware	<= 1.11b01 1.11b01 beta01
CPE cpe:2.3:o:dlink:dir-890l_firmware:::::::: cpe:2.3:o:dlink:dir-890l_firmware:1.11b01:beta01:::::: Remediation No remediation found in references.
dlink dir-890l	All versions
CPE cpe:2.3:h:dlink:dir-890l:-:::::::* Remediation No remediation found in references.
dlink dir-890r firmware	<= 1.11b01 1.11b01 beta01
CPE cpe:2.3:o:dlink:dir-890r_firmware:::::::: cpe:2.3:o:dlink:dir-890r_firmware:1.11b01:beta01:::::: Remediation No remediation found in references.
dlink dir-890r	All versions
CPE cpe:2.3:h:dlink:dir-890r:-:::::::* Remediation No remediation found in references.
dlink dir-885l firmware	<= 1.12b05
CPE cpe:2.3:o:dlink:dir-885l_firmware:::::::: Remediation No remediation found in references.
dlink dir-885l	All versions
CPE cpe:2.3:h:dlink:dir-885l:-:::::::* Remediation No remediation found in references.
dlink dir-885r firmware	<= 1.12b05
CPE cpe:2.3:o:dlink:dir-885r_firmware:::::::: Remediation No remediation found in references.
dlink dir-885r	All versions
CPE cpe:2.3:h:dlink:dir-885r:-:::::::* Remediation No remediation found in references.
dlink dir-895l firmware	<= 1.12b10
CPE cpe:2.3:o:dlink:dir-895l_firmware:::::::: Remediation No remediation found in references.
dlink dir-895l	All versions
CPE cpe:2.3:h:dlink:dir-895l:-:::::::* Remediation No remediation found in references.
dlink dir-895r firmware	<= 1.12b10
CPE cpe:2.3:o:dlink:dir-895r_firmware:::::::: Remediation No remediation found in references.
dlink dir-895r	All versions
CPE cpe:2.3:h:dlink:dir-895r:-:::::::* Remediation No remediation found in references.
dlink dir-818lx firmware	All versions
CPE cpe:2.3:o:dlink:dir-818lx_firmware:-:::::::* Remediation No remediation found in references.
dlink dir-818lx	All versions
CPE cpe:2.3:h:dlink:dir-818lx:-:::::::* Remediation No remediation found in references.

Change History

16 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 7, 2025	Modified Analysis	[email protected]
Oct 22, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Apr 3, 2025	Modified Analysis	[email protected]
Feb 4, 2025	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
Jun 27, 2024	Modified Analysis	[email protected]
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Jan 20, 2023	Modified Analysis	[email protected]
Jan 22, 2020	CVE Modified	[email protected]
Jan 15, 2020	Reanalysis	[email protected]
Jan 8, 2020	Initial Analysis	[email protected]

CVE-2019-17621 Details

Description

Metrics

References to Advisories, Solutions, and Tools

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO