CVE-2024-0769
D-Link DIR-859 Router Path Traversal Vulnerability
Description
CVE-2024-0769 is a medium-severity path traversal vulnerability in the D-Link DIR-859 router, specifically in firmware version 1.06B01. The flaw exists in the /hedwig.cgi component's HTTP POST Request Handler, where manipulation of the service argument allows an unauthenticated remote attacker to traverse directory paths and read sensitive configuration files, including DHCP bridge settings. With a CVSS v3.1 base score of 5.3 and a severity rating of MEDIUM, the vulnerability is limited to information disclosure. However, CISA has added CVE-2024-0769 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 75.24% at the 99th percentile indicates a very high probability of exploitation. Critically, the D-Link DIR-859 is an end-of-life product with no available patches, making this vulnerability particularly dangerous for organizations still using this router.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-859 firmware | 1.06 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md(Exploit, Third Party Advisory)
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371(Vendor Advisory)
- https://vuldb.com/?ctiid.251666(Permissions Required, VDB Entry)
- https://vuldb.com/?id.251666(Third Party Advisory, VDB Entry)
- https://nvd.nist.gov/vuln/detail/CVE-2024-0769(US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0769(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
The path traversal weakness in CVE-2024-0769 allows an attacker to craft input containing directory traversal sequences (such as "../") to access files and directories outside the intended restricted path. In the D-Link DIR-859 router, the /hedwig.cgi component fails to properly validate the service parameter, enabling traversal to sensitive configuration files on the device's filesystem.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Impact Analysis
The impact of CVE-2024-0769 is primarily focused on information disclosure. With an attack vector of Network (AV:N), the vulnerability is remotely exploitable without physical access to the device. The attack complexity is low (AC:L) and requires no authentication (PR:N) or user interaction (UI:N), making exploitation straightforward for any attacker who can reach the router's web interface. Confidentiality impact is rated Low, as the path traversal allows reading configuration files that may contain sensitive network settings, DHCP configurations, and potentially credentials. Integrity and Availability are not directly impacted by this vulnerability. Despite the MEDIUM CVSS score of 5.3, the EPSS score of 75.2% at the 99th percentile signals extremely high exploitation activity, likely driven by automated scanning tools targeting the large installed base of D-Link DIR-859 routers. The end-of-life status of this product means no patches will be released, leaving all remaining devices permanently vulnerable.
Exploit Maturity
CVE-2024-0769 has very high exploit maturity, confirmed by its inclusion in CISA's Known Exploited Vulnerabilities catalog and its EPSS score of 75.24% at the 99th percentile, placing it among the top 2% of all vulnerabilities in terms of exploitation probability. Public exploit code is available via GitHub, and multiple VDB entries document the vulnerability in detail. The D-Link DIR-859's end-of-life status means no firmware patches will be issued, and the large installed base of these routers ensures continued attacker interest. Automated scanning tools and botnets are known to target D-Link vulnerabilities, making exploitation essentially guaranteed for any internet-exposed DIR-859 device.
Remediation
-
Discontinue use of the D-Link DIR-859 immediately. The device is end-of-life and no firmware patches will be released. CISA's required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. D-Link has confirmed the product is no longer supported.
-
Replace the DIR-859 with a currently supported router from D-Link or another vendor that receives regular security updates. Ensure the replacement device runs the latest firmware version before deployment.
-
If immediate replacement is not possible, restrict access to the router's web management interface. Disable remote management, limit access to the /hedwig.cgi endpoint through firewall rules, and ensure the management interface is only accessible from trusted internal networks.
-
Audit network configurations for any sensitive data that may have been exposed through path traversal attacks, including DHCP settings, wireless credentials, and VPN configurations. Rotate any credentials that were stored on the device.
-
Monitor network traffic from and to the DIR-859 for indicators of compromise, including unusual outbound connections, DNS query anomalies, or traffic to known command-and-control infrastructure.
Technical Details
CVE-2024-0769 is a path traversal vulnerability in the D-Link DIR-859 router's /hedwig.cgi component, which handles HTTP POST requests for device configuration. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) and no user interaction (UI:N), with the scope unchanged (S:U) and only confidentiality impact rated low (C:L). The vulnerability is triggered by manipulating the service parameter in POST requests to the /hedwig.cgi endpoint, injecting directory traversal sequences such as ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml to access configuration files outside the intended web directory. The web server process on the DIR-859 fails to canonicalize or validate the path before serving the requested file, allowing the attacker to read XML configuration files containing network settings, DHCP configurations, and other sensitive device parameters. The firmware version 1.06B01 has been confirmed vulnerable, and since the DIR-859 is end-of-life, the underlying CGI handler will never receive a fix.
Frequently Asked Questions
Is CVE-2024-0769 being actively exploited?
Yes, CISA has added CVE-2024-0769 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 75.24% at the 99th percentile indicates a very high probability of exploitation. Public exploit code is available on GitHub.
What products are affected by CVE-2024-0769?
The D-Link DIR-859 router running firmware version 1.06B01 is affected. This product has been confirmed as end-of-life by D-Link, meaning no security patches will be released. All remaining DIR-859 devices in service are vulnerable.
How do I fix CVE-2024-0769?
The DIR-859 is end-of-life with no available patches. The recommended action is to discontinue use of the router and replace it with a currently supported device. If immediate replacement is not possible, disable remote management and restrict access to the web management interface from trusted networks only.
How severe is CVE-2024-0769?
CVE-2024-0769 has a CVSS v3.1 score of 5.3 (MEDIUM severity), reflecting its limitation to information disclosure through path traversal. However, the high exploitation activity (EPSS 75.24%, 99th percentile) and the lack of available patches significantly elevate the practical risk for organizations still using this device.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.