CVE-2019-17621

🗓️ 30 Dec 2019 16:09:17Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 513 Views🌐 WEB

D-Link DIR-859 Wi-Fi router CVE-2019-1762

Reporter	Title	Published	Views	Family All 27
0day.today	D-Link DIR-859 Unauthenticated Remote Command Execution Exploit	23 Jan 202000:00	–	zdt
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	8 Dec 202020:38	–	gitee
Gitee	Exploit for OS Command Injection in Dlink Dir-859_Firmware	14 Nov 202221:16	–	gitee
Gitee	Exploit for OS Command Injection in Dlink Dir-859_Firmware	27 Sep 202114:59	–	gitee
GithubExploit	Exploit for OS Command Injection in Dlink Dir-859_Firmware	20 Jul 202209:39	–	githubexploit
ATTACKERKB	CVE-2019-17621	28 Mar 201900:00	–	attackerkb
BDU FSTEC	The vulnerability of D-Link DIR-818Lx, DIR-822, DIR-823, DIR-859, DIR-865L, DIR-868L, DIR-869, DIR-880L, DIR-890L/R, DIR-885L/R, and DIR-895L/R routers stems from the failure to address the issue of eliminating special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands on behalf of the root user in the target system.	11 Feb 202000:00	–	bdu_fstec
Circl	CVE-2019-17621	21 Jan 202013:41	–	circl
CISA KEV Catalog	D-Link DIR-859 Router Command Execution Vulnerability	29 Jun 202300:00	–	cisa_kev
CISA	CISA Adds Eight Known Exploited Vulnerabilities to Catalog	29 Jun 202312:00	–	cisa

NVD

Node

AND

dlink dir-859_firmwareRange≤1.05b03

dlink dir-859_firmwareMatch1.06b01beta1

dlink dir-859Match-

Node

AND

dlink dir-822_firmwareRange≤2.03b01

dlink dir-822Match-

Node

AND

dlink dir-822_firmwareRange≤3.12b04

dlink dir-822Match-

Node

AND

dlink dir-823_firmwareRange≤1.00b06

dlink dir-823_firmwareMatch1.00b06beta

dlink dir-823Match-

Node

AND

dlink dir-865l_firmwareRange≤1.07b01

dlink dir-865lMatch-

Node

AND

dlink dir-868l_firmwareRange≤1.12b04

dlink dir-868lMatch-

Node

AND

dlink dir-868l_firmwareRange≤2.05b02

dlink dir-868lMatch-

Node

AND

dlink dir-869_firmwareRange≤1.03b02

dlink dir-869_firmwareMatch1.03b02beta02

dlink dir-869Match-

Node

AND

dlink dir-880l_firmwareRange≤1.08b04

dlink dir-880lMatch-

Node

AND

dlink dir-890l_firmwareRange≤1.11b01

dlink dir-890l_firmwareMatch1.11b01beta01

dlink dir-890lMatch-

Node

AND

dlink dir-890r_firmwareRange≤1.11b01

dlink dir-890r_firmwareMatch1.11b01beta01

dlink dir-890rMatch-

Node

AND

dlink dir-885l_firmwareRange≤1.12b05

dlink dir-885lMatch-

Node

AND

dlink dir-885r_firmwareRange≤1.12b05

dlink dir-885rMatch-

Node

AND

dlink dir-895l_firmwareRange≤1.12b10

dlink dir-895lMatch-

Node

AND

dlink dir-895r_firmwareRange≤1.12b10

dlink dir-895rMatch-

Node

AND

dlink dir-818lx_firmwareMatch-

dlink dir-818lxMatch-

Source	Link
dlink	www.dlink.com/en/security-bulletin
medium	www.medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9
ftc	www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
medium	www.medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
packetstormsecurity	www.packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
service	query param	/gena.cgi	OS command injection via UPnP on /gena.cgi using a crafted SUBSCRIBE request.	CWE-78

17 Jun 2026 02:24Current

9.3High risk

Vulners AI Score9.3

CVSS 3.19.8

CVSS 210

EPSS0.89624

SSVC