Exploit for CVE-2019-17621

kitploit · 2026-08-27

Description

Unauthenticated remote code execution in DLink devices.

Entry point

Parameterservice · query param

Path/gena.cgi

OS command injection in UPnP CGI via unauthenticated SUBSCRIBE to /gena.cgi with service parameter.

Affected Dlink dir-859 Firmware versions

Dlink dir-859 Firmware≤ 1.05b03, 1.06b01

All known vulnerabilities by product

D-Link Dir-818Lw D-Link Dir-822 D-Link Dir-823G D-Link Dir-859 D-Link Dir-865L D-Link Dir-868L D-Link Dir-869 D-Link Dir-880L

CVSS 10.0 for CVE-2019-17621

10.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

89.6%higher than 99.8% of all CVEs

Updated 2026-08-28

CVE Information

Exploit Details

Modified:2026-08-27 11:56

Last Seen:2026-08-27 23:37

Reporter:KitPloit

Tags

DLinkremote code executionunauthenticatedCVE-2019-17621

Other exploits for CVE-2019-17621

Exploit for OS Command Injection in Dlink Dir-859_Firmware

2022-11-14 baozhazhiziGITEE

Exploit for OS Command Injection in Dlink Dir-859_Firmware

2022-07-20 Squirre17GITHUB

Exploit for OS Command Injection in Dlink Dir-859_Firmware

2021-09-27 stemmmGITEE

Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform

2020-12-08 Keepb1ueGITEE

D-Link DIR-859 Unauthenticated Remote Command Execution Exploit

2020-01-23 metasploitZDTRuby

D-Link DIR-859 Unauthenticated Remote Command Execution

2020-01-22 Miguel Mendez ZPACKETSTORMRuby

D-Link DIR-859 Unauthenticated Remote Command Execution

2019-12-24 Miguel Mendez Z., <Miguel Mendez Z., @s1kr10s>, Pablo Pollanco P.METASPLOITRuby

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-SQUIRRE17-CVE-2019-17621
DLink RCE vulnerabilità CVE-2019-17621 rce non autenticato

FAT può emulare questo, quindi utilizza attifyos