CVE-2019-17621 : The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

Published 2019-12-30 17:15:20

Updated 2024-06-27 19:16:32

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-17621

Dlink » Dir-823 Firmware
Versions up to, including, (<=) 1.00b06
cpe:2.3:o:dlink:dir-823_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-823 » Version: N/A
Dlink » Dir-823 Firmware » Version: 1.00b06 Update Beta
cpe:2.3:o:dlink:dir-823_firmware:1.00b06:beta:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-823 » Version: N/A
Dlink » Dir-822 Firmware
Versions up to, including, (<=) 2.03b01
cpe:2.3:o:dlink:dir-822_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-822 » Version: N/A
Dlink » Dir-822 Firmware
Versions up to, including, (<=) 3.12b04
cpe:2.3:o:dlink:dir-822_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-822 » Version: N/A
Dlink » Dir-895l Firmware
Versions up to, including, (<=) 1.12b10
cpe:2.3:o:dlink:dir-895l_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-895l » Version: N/A
Dlink » Dir-890l Firmware
Versions up to, including, (<=) 1.11b01
cpe:2.3:o:dlink:dir-890l_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-890l » Version: N/A
Dlink » Dir-890l Firmware » Version: 1.11b01 Update Beta01
cpe:2.3:o:dlink:dir-890l_firmware:1.11b01:beta01:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-890l » Version: N/A
Dlink » Dir-885l Firmware
Versions up to, including, (<=) 1.12b05
cpe:2.3:o:dlink:dir-885l_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-885l » Version: N/A
Dlink » Dir-880l Firmware
Versions up to, including, (<=) 1.08b04
cpe:2.3:o:dlink:dir-880l_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-880l » Version: N/A
Dlink » Dir-868l Firmware
Versions up to, including, (<=) 1.12b04
cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-868l » Version: N/A
Dlink » Dir-868l Firmware
Versions up to, including, (<=) 2.05b02
cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-868l » Version: N/A
Dlink » Dir-895r Firmware
Versions up to, including, (<=) 1.12b10
cpe:2.3:o:dlink:dir-895r_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-895r » Version: N/A
Dlink » Dir-859 Firmware
Versions up to, including, (<=) 1.05b03
cpe:2.3:o:dlink:dir-859_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-859 » Version: N/A
Dlink » Dir-859 Firmware » Version: 1.06b01 Update Beta1
cpe:2.3:o:dlink:dir-859_firmware:1.06b01:beta1:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-859 » Version: N/A
Dlink » Dir-865l Firmware
Versions up to, including, (<=) 1.07b01
cpe:2.3:o:dlink:dir-865l_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-865l » Version: N/A
Dlink » Dir-869 Firmware
Versions up to, including, (<=) 1.03b02
cpe:2.3:o:dlink:dir-869_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-869 » Version: N/A
Dlink » Dir-869 Firmware » Version: 1.03b02 Update Beta02
cpe:2.3:o:dlink:dir-869_firmware:1.03b02:beta02:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-869 » Version: N/A
Dlink » Dir-890r Firmware
Versions up to, including, (<=) 1.11b01
cpe:2.3:o:dlink:dir-890r_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-890r » Version: N/A
Dlink » Dir-890r Firmware » Version: 1.11b01 Update Beta01
cpe:2.3:o:dlink:dir-890r_firmware:1.11b01:beta01:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-890r » Version: N/A
Dlink » Dir-885r Firmware
Versions up to, including, (<=) 1.12b05
cpe:2.3:o:dlink:dir-885r_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-885r » Version: N/A
Dlink » Dir-818lx Firmware » Version: N/A
cpe:2.3:o:dlink:dir-818lx_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-818lx » Version: N/A

CVE-2019-17621 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

D-Link DIR-859 Router Command Execution Vulnerability

CISA required action:

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

CISA description:

D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local netwo

Notes:

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147; https://nvd.nist.gov/vuln/detail/CVE-2019-17621

Added on 2023-06-29 Action due date 2023-07-20

Exploit prediction scoring system (EPSS) score for CVE-2019-17621

EPSS FAQ

96.86%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2019-17621

D-Link DIR-859 Unauthenticated Remote Command Execution

Disclosure Date: 2019-12-24

First seen: 2020-04-26

exploit/linux/upnp/dlink_dir859_subscribe_exec

D-Link DIR-859 Routers are vulnerable to OS command injection via the UPnP interface. The vulnerability exists in /gena.cgi (function genacgi_main() in /htdocs/cgibin), which is accessible without credentials. Authors: - Miguel Mendez Z., <Miguel Mendez Z., @s1kr10s

More information

CVSS scores for CVE-2019-17621

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-17621

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-17621

https://medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104

D-Link DIR-859 —Unauthenticated RCE (CVE-2019–17621) [EN]
Exploit;Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146

D-Link Technical Support
Patch;Vendor Advisory

CVEs referencing this url
https://medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9

D-Link DIR-859 — Unauthenticated RCE (CVE-2019–17621) [ES]
Exploit;Third Party Advisory
https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104

D-Link DIR-859 —Unauthenticated RCE (CVE-2019–17621) | by Miguel Méndez Z. | Medium
Exploit;Third Party Advisory
https://www.dlink.com/en/security-bulletin

Security Bulletin | D-Link
Vendor Advisory

CVEs referencing this url
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147

D-Link Technical Support
Patch;Vendor Advisory

CVEs referencing this url
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf

Third Party Advisory;US Government Resource

CVEs referencing this url
https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9

410 Deleted by author — Medium
Broken Link
http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html

D-Link DIR-859 Unauthenticated Remote Command Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2019-17621