⚠ Actively exploited
Added to CISA KEV on 2025-06-25. Federal agencies required to patch by 2025-07-16. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2024-0769 — Path Traversal in D-link Dir-859
Severity
9.8CRITICALNVD
CNA5.3VulnCheck5.3
EPSS
75.2%
top 1.12%
CISA KEV
KEV
Added 2025-06-25
Due 2025-07-16
Exploit
No known exploits
Affected products
Timeline
PublishedJan 21
KEV addedJun 25
KEV dueJul 16
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier a…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages2 packages
🔴Vulnerability Details
3🔍Detection Rules
1Suricata
▶