ZeroDay Findings
Sign inSign up

Findings

CVE-2019-17621

D-Link DIR-859 Router Command Execution Vulnerability

Published Dec 30, 2019 · updated Jun 16, 2026 · dlink dir-859 firmware

D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 30, 2019 · Catalog

    Detected

    D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

  2. Jun 29, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

  3. Jul 20, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Required action

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

CISA due date Jul 20, 2023

Affected

  • cpe dlink/dir-822 firmwareversion unspecified
  • cpe dlink/dir-823 firmwareversion unspecified
  • cpe dlink/dir-823 firmware1.00b06
  • cpe dlink/dir-859 firmwareversion unspecified
  • cpe dlink/dir-859 firmware1.06b01
  • cpe dlink/dir-865l firmwareversion unspecified
  • cpe dlink/dir-868l firmwareversion unspecified
  • cpe dlink/dir-869 firmwareversion unspecified
  • cpe dlink/dir-880l firmwareversion unspecified
  • cpe dlink/dir-890l firmwareversion unspecified
  • vendor D-Link DIR-859 Routerversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2019-17621

    D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2019-17621

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2019-17621

    30-day exploitation probability 89.6%

    first.org
  • Metasploit ModulesPublic exploit moduleexploit_linux/upnp/dlink_dir859_subscribe_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2019-17621

    The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References