{"id":"CVE-2019-17621","aliases":["EUVD-2019-7939","GHSA-4cjx-47hq-7hc2"],"status":"published","title":"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows...","description":"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.90615,"percentile":0.99805,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2019-12-30T16:09:17Z","modified":"2026-06-17T02:24:17Z","kev":{"date_added":"2023-06-29","due_date":"2023-07-20","required_action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-06-29"},{"source":"kev","since":"2023-06-29"}],"exploits":[{"source":"metasploit","id":"exploit/linux/upnp/dlink_dir859_subscribe_exec","title":"D-Link DIR-859 Unauthenticated Remote Command Execution","type":"exploit","platform":"Linux","date":"2019-12-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/upnp/dlink_dir859_subscribe_exec"},{"source":"pocgithub","id":"Squirre17/CVE-2019-17621","title":"Squirre17/CVE-2019-17621","date":"2022-07-20","url":"https://github.com/Squirre17/CVE-2019-17621"}],"products":[{"vendor":"d-link","product":"dir-859 router"},{"vendor":"dlink","product":"dir-818lx_firmware"},{"vendor":"dlink","product":"dir-822_firmware"},{"vendor":"dlink","product":"dir-823_firmware"},{"vendor":"dlink","product":"dir-859_firmware"},{"vendor":"dlink","product":"dir-865l_firmware"},{"vendor":"dlink","product":"dir-868l_firmware"},{"vendor":"dlink","product":"dir-869_firmware"},{"vendor":"dlink","product":"dir-880l_firmware"},{"vendor":"dlink","product":"dir-885l_firmware"},{"vendor":"dlink","product":"dir-885r_firmware"},{"vendor":"dlink","product":"dir-890l_firmware"},{"vendor":"dlink","product":"dir-890r_firmware"},{"vendor":"dlink","product":"dir-895l_firmware"},{"vendor":"dlink","product":"dir-895r_firmware"}],"references":[{"url":"https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.dlink.com/en/security-bulletin","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17621","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17621"},{"url":"https://medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104"},{"url":"https://medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9"},{"url":"https://github.com/advisories/GHSA-4cjx-47hq-7hc2"}],"sources":{"cve":[{"id":"CVE-2019-17621","description":"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.","status":"published","published":"2019-12-30T16:09:17Z","modified":"2025-10-21T23:35:54.315Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7939","description":"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.","status":"published","published":"2019-12-30T16:09:17Z","modified":"2025-10-21T23:35:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-06-29","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-4cjx-47hq-7hc2","title":"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows...","description":"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.","status":"published","published":"2022-05-24T17:05:15Z","modified":"2025-10-22T00:31:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2019-17621","title":"D-Link DIR-859 Router Command Execution Vulnerability","description":"D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.","cwes":["CWE-78"],"kev":{"date_added":"2023-06-29","due_date":"2023-07-20","required_action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2019-17621","description":"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.","status":"published","published":"2019-12-30T17:15:19.857Z","modified":"2026-06-17T02:24:17.42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:41.313583Z"}]}}