CVE-2019-17621
D-Link DIR-859 Router Command Execution Vulnerability
Description
CVE-2019-17621 is a critical OS command injection vulnerability in the D-Link DIR-859 Wi-Fi router and multiple related D-Link router models. The flaw exists in the UPnP endpoint at /gena.cgi, where an unauthenticated remote attacker can execute arbitrary system commands as root by sending a specially crafted HTTP SUBSCRIBE request. This command injection vulnerability in D-Link DIR-859 firmware versions 1.05 and 1.06B01 Beta01 requires no authentication or user interaction, making it extremely dangerous for exposed devices. CVE-2019-17621 has been added to CISA's Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.0% (99th percentile), exploitation is near-certain for any unpatched device.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-859 firmware | <= 1.05b03; 1.06b01 |
| dlink | dir-822 firmware | <= 2.03b01; <= 3.12b04 |
| dlink | dir-823 firmware | <= 1.00b06; 1.00b06 |
| dlink | dir-865l firmware | <= 1.07b01 |
| dlink | dir-868l firmware | <= 1.12b04; <= 2.05b02 |
| dlink | dir-869 firmware | <= 1.03b02; 1.03b02 |
| dlink | dir-880l firmware | <= 1.08b04 |
| dlink | dir-890l firmware | <= 1.11b01; 1.11b01 |
| dlink | dir-890r firmware | <= 1.11b01; 1.11b01 |
| dlink | dir-885l firmware | <= 1.12b05 |
| dlink | dir-885r firmware | <= 1.12b05 |
| dlink | dir-895l firmware | <= 1.12b10 |
| dlink | dir-895r firmware | <= 1.12b10 |
| dlink | dir-818lx firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104(Exploit, Third Party Advisory)
- https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9(Broken Link)
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146(Patch, Vendor Advisory)
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147(Patch, Vendor Advisory)
- https://www.dlink.com/en/security-bulletin(Vendor Advisory)
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17621(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In CVE-2019-17621, the D-Link DIR-859 router's UPnP service at /gena.cgi fails to properly sanitize user-supplied input in HTTP SUBSCRIBE requests before passing it to operating system commands. This allows an attacker to inject arbitrary shell commands that execute with root privileges on the router's underlying Linux operating system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
With a CVSS v3.1 score of 9.8 (Critical), CVE-2019-17621 represents one of the most severe vulnerability categories possible. The vulnerability is remotely exploitable without physical access over the network, requires no authentication and no user interaction, and the attack complexity is low, meaning no special conditions are needed to exploit it. Confidentiality, integrity, and availability are all rated High, meaning an attacker gains complete control over the router — able to intercept all network traffic, modify DNS settings, install persistent backdoors, and render the device inoperable. The EPSS score of 93.0% places this vulnerability in the 99th percentile, indicating near-certain active exploitation. Multiple D-Link router models beyond the DIR-859 are affected, including the DIR-822, DIR-823, DIR-865L, DIR-868L, DIR-869, DIR-880L, DIR-890L, and DIR-895L series, significantly expanding the attack surface across home and small business networks.
Exploit Maturity
Public exploit code is available for CVE-2019-17621 via Packet Storm Security and a detailed technical writeup with exploit details has been published. CISA has confirmed active exploitation in the wild by including CVE-2019-17621 in the Known Exploited Vulnerabilities catalog with a remediation deadline of July 20, 2023. The EPSS score of 93.0% (99th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted router vulnerabilities. The ransomware association is currently listed as unknown, but the availability of public exploits and root-level command execution make this vulnerability highly attractive for botnet recruitment and network pivot attacks.
Remediation
- Apply vendor patches immediately as directed by CISA: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. D-Link has released security advisories SAP10146 and SAP10147 with patched firmware.
- Update firmware on all affected D-Link router models, including DIR-859, DIR-822, DIR-823, DIR-865L, DIR-868L, DIR-869, DIR-880L, DIR-890L, DIR-890R, DIR-885L, DIR-885R, DIR-895L, DIR-895R, and DIR-818LX to the latest available firmware version from D-Link's support portal.
- Disable UPnP immediately on all affected routers as an interim mitigation if firmware updates are not yet available. The vulnerable endpoint /gena.cgi is part of the UPnP service, and disabling UPnP eliminates the attack vector entirely. Additionally, ensure the router's management interface is not exposed to the internet.
- Monitor network logs for suspicious HTTP SUBSCRIBE requests targeting /gena.cgi and review router logs for unexpected command execution, new user accounts, or unauthorized configuration changes that may indicate exploitation.
- Consider replacing end-of-life D-Link routers that no longer receive security updates with actively supported models, as command injection vulnerabilities in legacy firmware are unlikely to be patched if the product has reached end of support.
Technical Details
CVE-2019-17621 exploits an OS command injection vulnerability (CWE-78) in the UPnP service implementation of D-Link DIR-859 and related router models. The vulnerable endpoint /gena.cgi processes HTTP SUBSCRIBE requests as part of the UPnP event notification mechanism, but fails to sanitize user-controlled input before incorporating it into shell commands executed by the router's operating system. An attacker can craft a malicious SUBSCRIBE request containing shell metacharacters that break out of the intended command context and inject arbitrary commands, which execute with root privileges since the web server process runs as root. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case exploitability scenario: network-accessible, trivially simple to exploit, requiring no credentials or user interaction, with complete compromise of confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2019-17621 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2019-17621 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 20, 2023. The EPSS score of 93.0% places it in the 99th percentile, indicating near-certain exploitation. Public exploit code is readily available, lowering the barrier for attackers.
What products are affected by CVE-2019-17621?
CVE-2019-17621 affects a wide range of D-Link router models including the DIR-859 (firmware versions 1.05 and 1.06B01 Beta01), DIR-822, DIR-823, DIR-865L, DIR-868L, DIR-869, DIR-880L, DIR-890L, DIR-890R, DIR-885L, DIR-885R, DIR-895L, DIR-895R, and DIR-818LX. All of these models share the vulnerable UPnP implementation.
How do I fix CVE-2019-17621?
The recommended fix is to update the router firmware to the latest version provided by D-Link through their security advisories SAP10146 and SAP10147. As an immediate mitigation, disable UPnP on the affected router to eliminate the attack vector. If the router model has reached end of life without a patch, consider replacing it with a supported device.
How severe is CVE-2019-17621?
CVE-2019-17621 is rated Critical with a CVSS v3.1 score of 9.8 out of 10, the near-maximum severity. The vulnerability allows unauthenticated remote command execution as root with no user interaction required. Its EPSS score of 93.0% (99th percentile) confirms it is among the most actively exploited vulnerabilities tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.