Design/Logic Flaw

2019-12-3017:15:00

PRIOn knowledge base

www.prio-n.com

9.3 High

AI Score

Confidence

High

0.969 High

EPSS

Percentile

99.7%

JSON

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

CPENameOperatorVersion
dir-822_firmwareeq<= 2.3b1
dir-822_firmwareeq<= 3.12b4
dir-823_firmwareeq<= 1.0b6
dir-823_firmwareeq1.0b6 beta
dir-859_firmwareeq<= 1.5b3
dir-859_firmwareeq1.6b1 beta1
dir-865l_firmwareeq<= 1.7b1
dir-868l_firmwareeq<= 1.12b4
dir-868l_firmwareeq<= 2.5b2
dir-869_firmwareeq<= 1.3b2

Name	Operator	Version
dir-822_firmware	eq	<= 2.3b1
dir-822_firmware	eq	<= 3.12b4
dir-823_firmware	eq	<= 1.0b6
dir-823_firmware	eq	1.0b6 beta
dir-859_firmware	eq	<= 1.5b3
dir-859_firmware	eq	1.6b1 beta1
dir-865l_firmware	eq	<= 1.7b1
dir-868l_firmware	eq	<= 1.12b4
dir-868l_firmware	eq	<= 2.5b2
dir-869_firmware	eq	<= 1.3b2