CVE-2019-20213: D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GR
52
This month
HIGH 7.5REMOTEUPGRADEUPGRADEUPGRADE
CVE-2019-20213 is a high-severity flaw (CVSS 7.5) affecting dir-859 firmware, dir-822 firmware, dir-823 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
Published CVE record published
Updated Record last modified
dlink dir-859 firmware UPGRADE
Affected: <= 1.05b03 · 1.06b01 beta1
Fixed in: newer than 1.05b03
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
dlink dir-822 firmware UPGRADE
Affected: <= 2.03b01 · <= 3.12b04
Fixed in: newer than 3.12b04
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
dlink dir-823 firmware UPGRADE
Affected: <= 1.00b06
Fixed in: newer than 1.00b06
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
dlink dir-865l firmware UPGRADE
Affected: <= 1.07b01
Fixed in: newer than 1.07b01
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
dlink dir-868l firmware UPGRADE
Affected: <= 1.12b04 · <= 2.05b02
Fixed in: newer than 2.05b02
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
dlink dir-869 firmware UPGRADE
Affected: <= 1.03b02
Fixed in: newer than 1.03b02
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-20213?
dir-859 firmware: upgrade to newer than 1.05b03; dir-822 firmware: upgrade to newer than 3.12b04; dir-823 firmware: upgrade to newer than 1.00b06. Exact commands for each OS are on this page.
Is CVE-2019-20213 being exploited?
CVE-2019-20213 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-20213 affect?
CVE-2019-20213 affects dir-859 firmware, dir-822 firmware, dir-823 firmware. Severity is high (CVSS 7.5). D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
How urgent is CVE-2019-20213?
Priority 52/100. High severity; Remotely exploitable, no login, no user action
PatchTheCVE