CVE-2024-0769: D-Link DIR-859 Router Path Traversal Vulnerability

Vulnerability summary

CVE-2024-0769 is a critical (CVSS 9.8) Path Traversal vulnerability in D-Link DIR-859 Router. It is known to be exploited: CISA lists it, first on 25-06-2025. EPSS estimates a 82.71% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 21-01-2024
   PublishedVulnerability first disclosed.
2. 25-06-2025
   Added to CISA KEVD-Link DIR-859 Router Path Traversal Vulnerability
3. 16-07-2025
   CISA remediation dueApply mitigations per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.