CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

89.62% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2023-06-29

Published

2019-12-30

Updated

2025-10-21

Proof-of-concept exploits (5)

• http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command…
• https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a…
• Squirre17/CVE-2019-176213★ · 2022-07-20
• doudoudedi/hackEmbedded206★ · 2026-07-26
• wzg-gie/hackEmbedded-main1★ · 2026-09-29

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/upnp/dlink_dir859_subscrib…

Security advisories

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147
• https://www.dlink.com/en/security-bulletin
• https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19…

References

• CVE Record
• NVD entry

Related

• CVE-2019-8985
• CVE-2021-4034
• CVE-2022-42703
• CVE-2021-39509
• CVE-2021-39510
• CVE-2021-40546