D-Link DIR-859 1.05/1.06B01 Beta01 UPnP Service /gena.cgi SUBSCRIBE Request os command injection

Summaryinfo

A vulnerability marked as very critical has been reported in D-Link DIR-859 1.05/1.06B01 Beta01. Affected by this issue is some unknown functionality of the file /gena.cgi of the component UPnP Service. This manipulation as part of SUBSCRIBE Request causes os command injection. This vulnerability is tracked as CVE-2019-17621. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability classified as very critical was found in D-Link DIR-859 1.05/1.06B01 Beta01 (Router Operating System). Affected by this vulnerability is an unknown code of the file /gena.cgi of the component UPnP Service. The manipulation as part of a SUBSCRIBE Request leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

The weakness was disclosed 12/30/2019 (Website). It is possible to read the advisory at supportannouncement.us.dlink.com. This vulnerability is known as CVE-2019-17621 since 10/16/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a exploit are known. The pricing for an exploit might be around USD $25k-$100k at the moment (estimation calculated on 02/05/2025). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

It is declared as attacked. We expect the 0-day to have been worth approximately $25k-$100k. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 06/29/2023 with a due date of 07/20/2023:

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-859

Version

• 1.05
• 1.06B01 Beta01

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion