CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows...

9.8 CriticalIn KEVPublic exploit

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

90.6%Up 77.1 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2019-17621
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-78
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2019-17621
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2019-7939 9.8

Record: EUVD-2019-7939
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4cjx-47hq-7hc2 9.8

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows...

Record: GHSA-4cjx-47hq-7hc2
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

CISA KEV No score

D-Link DIR-859 Router Command Execution Vulnerability

D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Record: CVE-2019-17621
Weakness: CWE-78
Updated: 2026-11-02

Affected products

Show 3 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	D-Link DIR-859 Unauthenticated Remote Command Execution	2019-12-24
PoC in GitHub	Squirre17/CVE-2019-17621	2022-07-20

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-17621 is a critical vulnerability (CVSS 9.8) in D-link Dir-859 Router, published December 30, 2019. CISA lists it as known to be exploited, since June 29, 2023. EUVD reports exploitation since June 29, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.6%, the 99th percentile. No source names a fixed version.

References

Show 6 moreShow less