CVE-2019-20215: dlink dir-859_firmware OS Command Injection

EPSS trend

Probability

75.11%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 75.11% on 19-09-2026

19-09-202619-10-2026

EPSS score

75.11%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

exploit-databaseremotelinux_mipsVerified
D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi
exploit/linux/upnp/dlink_dir859_exec_ssdpcgi
Maturity: weaponized
MetasploitremoteVerified
D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet.
exploit/linux/upnp/dlink_upnp_msearch_exec
Maturity: weaponized

References

3 links

supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147X Refsource CONFIRMPatchVendor Advisory
medium.com/%40s1kr10s/…X Refsource MISC
packetstormsecurity.com/files/156250/D-Link-ssdpcgi-Unauthenticated-Remote-Command-Execution.htmlX Refsource MISC

Related vulnerabilities

CVE-2022-25106dlinkdir-859_firmware+18.59%4y ago04-03-2022 19:20D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.CVE-2024-0769d-linkdir-859+1KEV82.71%2y ago21-01-2024 08:00** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.CVE-2019-20217dlinkdir-859_firmware3.56%6y ago29-01-2020 02:32D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.CVE-2019-20216dlinkdir-859_firmware3.67%6y ago29-01-2020 02:28D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.CVE-2019-20213dlinkdir-818lx_firmware+132.18%6y ago02-01-2020 01:03D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.CVE-2019-17621dlinkdir-818lx_firmware+13KEV89.62%6y ago30-12-2019 16:09The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

All vulnerabilities indir-859_firmware

CVE-2019-20215: dlink dir-859_firmware OS Command Injection

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References