{"id":"CVE-2019-17621","kind":"vulnerability","aliases":["CVE-2019-17621"],"related":[],"title":"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated…","description":"D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.\n\nCISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","summary":"D-Link DIR-859 routers have a command execution flaw in the UPnP service at /gena.cgi. An unauthenticated attacker on the local network can send a crafted HTTP SUBSCRIBE request and run system commands as root.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2023-06-29T00:00:00+00:00","products":[{"name":"D-Link DIR-859 Router","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dir-859 firmware","fixed":[],"affected":"<= 1.05b03","ecosystem":"vendor"},{"name":"dlink dir-859 firmware","fixed":[],"affected":"= 1.06b01","ecosystem":"vendor"},{"name":"dlink dir-822 firmware","fixed":[],"affected":"<= 2.03b01","ecosystem":"vendor"},{"name":"dlink dir-822 firmware","fixed":[],"affected":"<= 3.12b04","ecosystem":"vendor"},{"name":"dlink dir-823 firmware","fixed":[],"affected":"<= 1.00b06","ecosystem":"vendor"},{"name":"dlink dir-823 firmware","fixed":[],"affected":"= 1.00b06","ecosystem":"vendor"},{"name":"dlink dir-865l firmware","fixed":[],"affected":"<= 1.07b01","ecosystem":"vendor"},{"name":"dlink dir-868l firmware","fixed":[],"affected":"<= 1.12b04","ecosystem":"vendor"},{"name":"dlink dir-868l firmware","fixed":[],"affected":"<= 2.05b02","ecosystem":"vendor"},{"name":"dlink dir-869 firmware","fixed":[],"affected":"<= 1.03b02","ecosystem":"vendor"},{"name":"dlink dir-869 firmware","fixed":[],"affected":"= 1.03b02","ecosystem":"vendor"},{"name":"dlink dir-880l firmware","fixed":[],"affected":"<= 1.08b04","ecosystem":"vendor"},{"name":"dlink dir-890l firmware","fixed":[],"affected":"<= 1.11b01","ecosystem":"vendor"},{"name":"dlink dir-890l firmware","fixed":[],"affected":"= 1.11b01","ecosystem":"vendor"},{"name":"dlink dir-890r firmware","fixed":[],"affected":"<= 1.11b01","ecosystem":"vendor"},{"name":"dlink dir-890r firmware","fixed":[],"affected":"= 1.11b01","ecosystem":"vendor"},{"name":"dlink dir-885l firmware","fixed":[],"affected":"<= 1.12b05","ecosystem":"vendor"},{"name":"dlink dir-885r firmware","fixed":[],"affected":"<= 1.12b05","ecosystem":"vendor"},{"name":"dlink dir-895l firmware","fixed":[],"affected":"<= 1.12b10","ecosystem":"vendor"},{"name":"dlink dir-895r firmware","fixed":[],"affected":"<= 1.12b10","ecosystem":"vendor"},{"name":"dlink dir-818lx firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","dir-859","exploited","infrastructure","routers","self-hosted","upnp"],"not_affected_if":["no-dir-859-deployed","upnp-disabled"],"how_to_check":"Identify any D-Link DIR-859 routers in use, including firmware version via the admin interface.\nCheck whether UPnP is enabled on the router.","fix":"Apply the vendor firmware update per D-Link instructions, or stop using the DIR-859 if no update is available.\nDisable UPnP as a mitigation until patched.","status":"open","published_at":"2019-12-30T17:15:19+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:29+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T21:06:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor firmware update per D-Link instructions, or stop using the DIR-859 if no update is available.\nDisable UPnP as a mitigation until patched.","reach":"network","impact":"high","summary":"D-Link DIR-859 routers have a command execution flaw in the UPnP service at /gena.cgi. An unauthenticated attacker on the local network can send a crafted HTTP SUBSCRIBE request and run system commands as root.","category":"infrastructure","who_cares":["d-link","dir-859","routers","upnp","self-hosted"],"confidence":0.85,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary system commands as root on the router","analyst_note":"Find the fixed firmware version and whether UPnP is on by default, using the vendor advisory and the CISA KEV entry.","how_to_check":"Identify any D-Link DIR-859 routers in use, including firmware version via the admin interface.\nCheck whether UPnP is enabled on the router.\nunknown","needs_analyst":true,"not_affected_if":["no-dir-859-deployed","upnp-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000505,"input_tokens":2873,"output_tokens":435,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-17621':27A,30A '-2019':26A,29A '-822':47A,51A '-823':55A,59A '-859':12A,35A,39A,43A,138B,150B,187C '-869':78A,82A '/gena.cgi':5A,162B,199C '1.05':17A '1.06':19A '818lx':132A '865l':64A '868l':69A,74A '880l':87A '885l':112A '885r':117A '890l':92A,97A '890r':102A,107A '895l':122A '895r':127A 'action':232C 'allow':22A,201C 'appli':233C 'attack':165B,205C 'b01':20A 'beta01':21A 'cisa':230C 'command':154B,180B,191C,209C 'connect':225C 'contain':189C 'craft':173B,216C 'cve':25A,28A 'd':9A,32A,135B,147B,184C 'd-link':8A,31A,134B,146B,183C 'dir':11A,34A,38A,42A,46A,50A,54A,58A,63A,68A,73A,77A,81A,86A,91A,96A,101A,106A,111A,116A,121A,126A,131A,137B,149B,186C 'dir-818lx':130A 'dir-865l':62A 'dir-868l':67A,72A 'dir-880l':85A 'dir-885l':110A 'dir-885r':115A 'dir-890l':90A,95A 'dir-890r':100A,105A 'dir-895l':120A 'dir-895r':125A 'discontinu':239C 'dlink':37A,41A,45A,49A,53A,57A,61A,66A,71A,76A,80A,84A,89A,94A,99A,104A,109A,114A,119A,124A,129A 'endpoint':3A,197C 'execut':155B,192C,207C 'exploit':139B,200C 'fi':15A 'firmware':40A,44A,48A,52A,56A,60A,65A,70A,75A,79A,83A,88A,93A,98A,103A,108A,113A,118A,123A,128A,133A 'flaw':156B 'host':144B 'http':174B,217C 'infrastructur':140B 'instruct':237C 'link':10A,33A,136B,148B,185C 'local':168B,228C 'network':169B,229C 'per':235C 'product':243C 'remot':204C 'request':176B,219C 'requir':231C 'root':182B,211C 'router':16A,36A,141B,151B,188C 'run':178B 'self':143B 'self-host':142B 'send':171B,213C 'servic':160B,223C 'special':215C 'subscrib':175B,218C 'system':179B,208C 'unauthent':24A,164B,203C 'unavail':247C 'updat':234C,245C 'upnp':2A,145B,159B,196C,222C 'url':4A,198C 'use':240C 'vendor':236C 'vulner':193C 'wi':14A 'wi-fi':13A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-30T17:15:19+00:00","kev":{"dateAdded":"2023-06-29","dueDate":"2023-07-20","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-17621","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-17621","severity":null,"published_at":"2023-06-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-17621","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17621","severity":null,"published_at":"2019-12-30T17:15:19+00:00","modified_at":"2026-06-17T02:24:17+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}