Description
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf ↗
- https://www.dlink.com/en/security-bulletin ↗
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 ↗
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146 ↗
- https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104 ↗
- https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9 ↗
- http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17621 ↗