CVE-2019-17621
D-Link DIR-859 Router Command Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CISA notes
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147; https://nvd.nist.gov/vuln/detail/CVE-2019-17621
Description
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitation Context
as of October 17, 2026- CISA added CVE-2019-17621 to the KEV catalog 1,277 days after its CVE record was published. The median for entries added in 2023 is 12 days.
- It is one of 27 D-Link entries in the CISA KEV catalog, and one of 2 added in 2023.
- Its current EPSS score (89.6%) is higher than that of 72% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| - | - | n/a |
References
7 Links- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
- https://www.dlink.com/en/security-bulletin
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
- https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104
- https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9
- http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html
Record Details
More from D-Link
D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
D-Link Multiple Routers Command Injection Vulnerability
D-Link DNS-320 Device Command Injection Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.