PT-2019-4530 · D Link · D-Link Dir-859+10

Published 2019-12-12 · Updated 2025-04-03 · CVE-2019-17621

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-818Lx versions not specified D-Link DIR-822 versions not specified D-Link DIR-823 versions not specified D-Link DIR-859 versions 1.05 through 1.06B01 Beta01 D-Link DIR-865L versions not specified D-Link DIR-868L versions not specified D-Link DIR-869 versions not specified D-Link DIR-880L versions not specified D-Link DIR-890L/R versions not specified D-Link DIR-885L/R versions not specified D-Link DIR-895L/R versions not specified

Description The issue exists due to the failure to neutralize special elements used in the operating system command. This can allow a remote attacker to execute arbitrary commands as the root user in the target system due to incorrect handling of the SUBSCRIBE request in the /gena.cgi file. The estimated number of potentially affected devices is not specified.

Recommendations For D-Link DIR-859 versions 1.05 through 1.06B01 Beta01, consider disabling access to the /gena.cgi endpoint until a patch is available. For other affected versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-00558

CVE-2019-17621

Affected Products

D-Link Dir-818Lw

D-Link Dir-822

D-Link Dir-823G

D-Link Dir-859

D-Link Dir-865L

D-Link Dir-868L

D-Link Dir-869

D-Link Dir-880L

D-Link Dir-885L

D-Link Dir-890L

D-Link Dir-895L/R

References · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/upnp/dlink_dir859_subscribe_exec.rb · Exploit
• 🔥 https://github.com/Squirre17/CVE-2019-17621 · Exploit
• 🔥 https://medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9 · Exploit
• 🔥 http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html · Exploit
• 🔥 https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104 · Exploit
• 🔥 https://medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17621 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17621 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00558 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146 · Vendor Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 · Vendor Advisory, Security Note
• https://t.me/sysadm_in_channel/1374 · Telegram Post
• https://ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf · Note
• https://t.me/aptreports/4510 · Telegram Post