CVE-2019-17621
published 2019-12-30CVE-2019-17621: The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands…
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2023-07-20
Exploited in the wild
EPSS
89.62%
99.8th percentile
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-822_firmware | <= 2.03b01 | — |
| dlink | dir-822_firmware | <= 3.12b04 | — |
| dlink | dir-823_firmware | <= 1.00b06 | — |
| dlink | dir-823_firmware | — | — |
| dlink | dir-859_firmware | <= 1.05b03 | — |
| dlink | dir-859_firmware | — | — |
| dlink | dir-865l_firmware | <= 1.07b01 | — |
| dlink | dir-868l_firmware | <= 1.12b04 | — |
| dlink | dir-868l_firmware | <= 2.05b02 | — |
| dlink | dir-869_firmware | <= 1.03b02 | — |
| dlink | dir-869_firmware | — | — |
| dlink | dir-880l_firmware | <= 1.08b04 | — |
| dlink | dir-885l_firmware | <= 1.12b05 | — |
| dlink | dir-885r_firmware | <= 1.12b05 | — |
| dlink | dir-890l_firmware | <= 1.11b01 | — |
| dlink | dir-890l_firmware | — | — |
| dlink | dir-890r_firmware | <= 1.11b01 | — |
| dlink | dir-890r_firmware | — | — |
| dlink | dir-895l_firmware | <= 1.12b10 | — |
| dlink | dir-895r_firmware | <= 1.12b10 | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link gena.cgi service Parameter Command Injection Attempt (CVE-2025-13562, CVE-2024-23624, CVE-2019-17621)"; flow:established,to_server; content:"SUBSCRIBE /gena.cgi|3f|service|3d|"; fast_pattern; depth:28; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; content:"NT|3a 20|"; content:"Callback|3a 20|"; reference:cve,2019-17621; reference:cve,2025-13562; reference:cve,2024-23624; classtype:attempted-admin; sid:2066991; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_01_23, cve CVE_2019_17621, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_01_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes↗
SUBSCRIBE /gena.cgi?service=
- →Look for HTTP SUBSCRIBE requests targeting /gena.cgi with shell metacharacters (;, newline, backtick, pipe, $) injected into the 'service' query parameter — these indicate command injection exploitation attempts. ↗
- →Exploit traffic is plaintext (no TLS); detection should be applied at both perimeter and internal network segments to catch lateral exploitation attempts. ↗
- →Malicious SUBSCRIBE requests will contain both 'NT:' and 'Callback:' HTTP headers alongside the crafted /gena.cgi?service= URI — all three elements together are a strong signal of exploitation. ↗
- →The vulnerable code path is the genacgi_main() function inside /htdocs/cgibin on the D-Link DIR-859; process-level monitoring for unexpected child processes spawned from this binary can indicate post-exploitation. ↗
- →Check Point IPS blade detects exploitation activity under the signature name 'Command Injection Over HTTP'; use this as a cross-vendor correlation label. ↗
- ·The vulnerability is only exploitable from the local network (LAN-side UPnP service), not directly from the internet — perimeter blocking alone is insufficient if an attacker has LAN access. ↗
- ·The endpoint /gena.cgi requires no authentication, meaning no credential-based detection or alerting on failed logins will surface exploitation of this vulnerability. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4cjx-47hq-7hc2: The UPnP endpoint URL /gena
ghsa_unreviewed·2022-05-24
CVE-2019-17621 [HIGH] CWE-78 GHSA-4cjx-47hq-7hc2: The UPnP endpoint URL /gena
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
VulnCheck
D-Link DIR-859 Router Command Execution Vulnerability
vulncheck·2019·CVSS 9.8
CVE-2019-17621 [CRITICAL] CWE-78 D-Link DIR-859 Router Command Execution Vulnerability
D-Link DIR-859 Router Command Execution Vulnerability
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Affected: D-Link DIR-859 Router
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Exploitation References: https://unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-09-08&host_type=src&vul
CISA
D-Link DIR-859 Router Command Execution Vulnerability
cisa·2023-06-29·CVSS 9.8
CVE-2019-17621 [CRITICAL] CWE-78 D-Link DIR-859 Router Command Execution Vulnerability
Vulnerability: D-Link DIR-859 Router Command Execution Vulnerability
Affected: D-Link DIR-859 Router
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Notes: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147; https://nvd.nist.gov/vuln/detail/CVE-2019-17621
Remediation Due Date: 2023-07-20
Suricata
ET WEB_SPECIFIC_APPS D-Link gena.cgi service Parameter Command Injection Attempt (CVE-2025-13562, CVE-2024-23624, CVE-2019-17621)
suricata·2026-01-23·CVSS 9.8
CVE-2019-17621 [CRITICAL] ET WEB_SPECIFIC_APPS D-Link gena.cgi service Parameter Command Injection Attempt (CVE-2025-13562, CVE-2024-23624, CVE-2019-17621)
ET WEB_SPECIFIC_APPS D-Link gena.cgi service Parameter Command Injection Attempt (CVE-2025-13562, CVE-2024-23624, CVE-2019-17621)
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link gena.cgi service Parameter Command Injection Attempt (CVE-2025-13562, CVE-2024-23624, CVE-2019-17621)"; flow:established,to_server; content:"SUBSCRIBE /gena.cgi|3f|service|3d|"; fast_pattern; depth:28; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; content:"NT|3a 20|"; content:"Callback|3a 20|"; reference:cve,2019-17621; reference:cve,2025-13562; reference:cve,2024-23624; classtype:attempted-admin; sid:2066991; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_01
Unit42
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
blogs_unit42·2023-06-22·CVSS 9.8
CVE-2019-12725 [CRITICAL] IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
## Executive Summary
Since March 2023, Unit 42 researchers have observed threat actors leveraging several IoT vulnerabilities to spread a variant of the Mirai botnet. The vulnerabilities exploited include those listed in the following table:
CVE/Product
Description
CVE-2019-12725
Zeroshell Remote Command Execution Vulnerability
CVE-2019-17621
D-Link DIR-859 Remote Command Injection Vulnerability
CVE-2019-20500
D-Link DWL-2600AP Remote Command Execution Vulnerability
CVE-2021-25296
Nagios XI Remote Command Injection Vulnerability
CVE-2021-46422
Telesquare SDT-CW3B1 Router Command Injection Vulnerability
CVE-2022-27002
Arris TR3300 Remote Command Injection Vulnerability
CVE-2022-29303
SolarView Compact Command Injection Vulnerability
CVE-2022-30023
Tenda HG9 Router Command Injectio
Unit42
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
blogs_unit42·2023-06-22·CVSS 9.8
CVE-2019-12725 [CRITICAL] IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Threat Research Center
Trend Reports
Vulnerabilities
## IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Chao Lei
Zhibin Zhang
Yiheng An
Cecilia Hu
Published: June 22, 2023
Trend Reports
Vulnerabilities
Botnet
CVE-2019-12725
CVE-2019-17621
CVE-2019-20500
CVE-2021-25296
CVE-2021-46422
CVE-2022-27002
CVE-2022-29303
CVE-2022-30023
CVE-2022-30525
CVE-2022-31499
CVE-2022-36266
CVE-2022-40005
CVE-2022-45699
CVE-2023-1389
CVE-2023-25280
CVE-2023-27240
IoT
IoT Security
Mirai
## Executive Summary
Since March 2023, Unit 42 researchers have observed threat actors leveraging several IoT vulnerabilities to spread a variant of the Mirai botnet. The vulnerabilities exploited include those listed in the following table:
CVE/Pro
Checkpoint
6th January – Threat Intelligence Bulletin
blogs_checkpoint·2020-01-06
CVE-2019-17621 6th January – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 6th January – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 6th January 2020, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
The Dutch university of Maastricht has been hit by a ransomware attack and its systems are still unavailable, more than a week after the initial detection of the attack. Experts link Clop, the ransomware used in the event, to the Russian cyber threat group TA505.
Check Point SandBlast provides protection against thi
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.htmlhttps://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147https://www.dlink.com/en/security-bulletinhttps://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfhttp://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.htmlhttps://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147https://www.dlink.com/en/security-bulletinhttps://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17621
2019-12-30
Published
2023-06-29
Added to CISA KEV
Exploited in the wild