Lucene search

[email protected]CVE-2019-17621

HistoryDec 30, 2019 - 5:15 p.m.

CVE-2019-17621

2019-12-3017:15:19

CWE-78

[email protected]

web.nvd.nist.gov

343

In Wild

d-link

dir-859

wi-fi router

cve-2019-17621

upnp

security vulnerability

remote code execution

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.969 High

EPSS

Percentile

99.7%

JSON

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Affected configurations

NVD

Node

dlinkdir-859_firmwareRange≤1.05b03

dlinkdir-859_firmwareMatch1.06b01beta1

AND

dlinkdir-859Match-

Node

dlinkdir-822_firmwareRange≤2.03b01

AND

dlinkdir-822Match-

Node

dlinkdir-822_firmwareRange≤3.12b04

AND

dlinkdir-822Match-

Node

dlinkdir-823_firmwareRange≤1.00b06

dlinkdir-823_firmwareMatch1.00b06beta

AND

dlinkdir-823Match-

Node

dlinkdir-865l_firmwareRange≤1.07b01

AND

dlinkdir-865lMatch-

Node

dlinkdir-868l_firmwareRange≤1.12b04

AND

dlinkdir-868lMatch-

Node

dlinkdir-868l_firmwareRange≤2.05b02

AND

dlinkdir-868lMatch-

Node

dlinkdir-869_firmwareRange≤1.03b02

dlinkdir-869_firmwareMatch1.03b02beta02

AND

dlinkdir-869Match-

Node

dlinkdir-880l_firmwareRange≤1.08b04

AND

dlinkdir-880lMatch-

Node

dlinkdir-890l_firmwareRange≤1.11b01

dlinkdir-890l_firmwareMatch1.11b01beta01

AND

dlinkdir-890lMatch-

Node

dlinkdir-890r_firmwareRange≤1.11b01

dlinkdir-890r_firmwareMatch1.11b01beta01

AND

dlinkdir-890rMatch-

Node

dlinkdir-885l_firmwareRange≤1.12b05

AND

dlinkdir-885lMatch-

Node

dlinkdir-885r_firmwareRange≤1.12b05

AND

dlinkdir-885rMatch-

Node

dlinkdir-895l_firmwareRange≤1.12b10

AND

dlinkdir-895lMatch-

Node

dlinkdir-895r_firmwareRange≤1.12b10

AND

dlinkdir-895rMatch-

Node

dlinkdir-818lx_firmwareMatch-

AND

dlinkdir-818lxMatch-

CPENameOperatorVersion
dlink:dir-859_firmwaredlink dir-859 firmwarele1.05b03
dlink:dir-859_firmwaredlink dir-859 firmwareeq1.06b01

CPE	Name	Operator	Version
dlink:dir-859_firmware	dlink dir-859 firmware	le	1.05b03
dlink:dir-859_firmware	dlink dir-859 firmware	eq	1.06b01

References

packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html

medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104

medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9

supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146

supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147

www.dlink.com/en/security-bulletin

www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf

Social References

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.969 High

EPSS

Percentile

99.7%

JSON

Related for CVE-2019-17621

prion1 zdt1 cvelist1 packetstorm1 nvd1 cisa_kev1 attackerkb1 checkpoint_advisories1 nessus1 thn1