Dir-859 Firmware vulnerabilitiesAnd the versions its exploited flaws hit.
Dir-859 Firmware is made by Dlink. We track 8 published vulnerabilities in it, across 5 versions. 2 of them are on the list of flaws known to be exploited, the newest added on 25 June 2025. If you run Dir-859 Firmware, check your version against the exploited flaws below and patch those first.
The most recent Dir-859 Firmware flaw added to the known-exploited list is CVE-2024-0769, on 25 June 2025. We keep watching the known-exploited list.
Which versions of Dir-859 Firmware do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2024-0769Exploited list, 25 Jun 2025
D-Link DIR-859 Router Path Traversal Vulnerability
1.06-beta1 - CVE-2019-17621Exploited list, 29 Jun 2023
D-Link DIR-859 Router Command Execution Vulnerability
up to 1.05b031.06b01-beta1
Which Dir-859 Firmware vulnerabilities are being exploited?
2 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 5.3D-Link DIR-859 Router Path Traversal Vulnerability
D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler.
- 9.8D-Link DIR-859 Router Command Execution Vulnerability
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi.
Which Dir-859 Firmware flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 90%
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE...
- 83%
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01.
- 75%CVE-2019-20215Critical
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled.
- 8.6%CVE-2022-25106Medium
D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main.
- 3.7%CVE-2019-20216Critical
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled.
- 3.6%CVE-2019-20217Critical
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled.
- 2.2%CVE-2019-20213High
D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
- 1.7%CVE-2023-36092Critical
Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main.
Running Dir-859 Firmware? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- Matched to
- Dir-859 Firmware on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 8 published vulnerabilities listed under the name Dir-859 Firmware, across 5 versions. The most recent Dir-859 Firmware flaw added to the known-exploited list is CVE-2024-0769, on 25 June 2025.
2 are on the list of flaws known to be exploited. The most recently added are CVE-2024-0769 and CVE-2019-17621.
Each flaw names its own versions, usually as ranges. The newest, CVE-2024-0769, affects 1.06-beta1. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Dir-859 Firmware. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.