PatchTheCVECVE-2019-17621: D-Link DIR-859 Router Command Execution Vulnerability
CVE-2019-17621 is a critical-severity flaw (CVSS 9.8) affecting dir-859 firmware, dir-822 firmware, dir-823 firmware, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Public exploit reference
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 90.6% (top 1%) |
| CISA exploited list | Yes, fix due 2023-07-20 |
| Weakness | CWE-78 |
| Published | 2019-12-30 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: Squirre17/CVE-2019-17621 (3 stars)
- Write-up: medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104
- Write-up: medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9
- Write-up: medium.com/@s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104
- Metasploit: D-Link DIR-859 Unauthenticated Remote Command Execution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-17621?
dir-859 firmware: upgrade to newer than 1.05b03; dir-822 firmware: upgrade to newer than 3.12b04; dir-823 firmware: upgrade to newer than 1.00b06. Exact commands for each OS are on this page.
Is CVE-2019-17621 being exploited?
Yes. CVE-2019-17621 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2019-17621 affect?
CVE-2019-17621 affects dir-859 firmware, dir-822 firmware, dir-823 firmware. Severity is critical (CVSS 9.8). The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP servi
How urgent is CVE-2019-17621?
Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action
Software pages
D-Link vulnerabilities · Wi-Fi vulnerabilities
Related CVEs
- CVE-2024-0769 MEDIUM 5.3 EXPLOITED MITIGATE D-Link DIR-859 Router Path Traversal Vulnerability
- CVE-2023-36092 CRITICAL 9.8 MITIGATE Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privi
- CVE-2022-25106 MEDIUM 5.5 MITIGATE MITIGATE D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main
- CVE-2019-20217 CRITICAL 9.8 MITIGATE D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the
- CVE-2019-20216 CRITICAL 9.8 MITIGATE D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the