ZeroDay Findings
Sign inSign up

Findings

CVE-2019-17621

D-Link DIR-859 Router Command Execution Vulnerability

Published Dec 30, 2019 · updated Jun 16, 2026 · dlink dir-859 firmware

D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 30, 2019 · Catalog

    Detected

    D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

  2. Jun 29, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

  3. Jul 20, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Required action

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

CISA due date Jul 20, 2023

Affected

  • cpe dlink/dir-822 firmwareversion unspecified
  • cpe dlink/dir-823 firmwareversion unspecified
  • cpe dlink/dir-823 firmware1.00b06
  • cpe dlink/dir-859 firmwareversion unspecified
  • cpe dlink/dir-859 firmware1.06b01
  • cpe dlink/dir-865l firmwareversion unspecified
  • cpe dlink/dir-868l firmwareversion unspecified
  • cpe dlink/dir-869 firmwareversion unspecified
  • cpe dlink/dir-880l firmwareversion unspecified
  • cpe dlink/dir-890l firmwareversion unspecified
  • vendor D-Link DIR-859 Routerversion unspecified

Sources

  • CISA KEVCVE-2019-17621

    D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

    cisa.gov
  • CVE.orgCVE-2019-17621

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-17621

    30-day exploitation probability 89.6%

    first.org
  • Metasploit Modulesexploit_linux/upnp/dlink_dir859_subscribe_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2019-17621

    The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2019-17621 · ZeroDay Findings