CVE-2019-17621

What is the D-Link DIR-859?

The DIR-859 is a consumer dual-band Wi-Fi router from D-Link, providing home internet connectivity, wireless access, and Universal Plug and Play (UPnP) support for automatic device/service discovery on the local network. Like many consumer routers, its UPnP implementation runs with elevated privileges as part of the embedded Linux firmware's web-facing services.

Overview

CVE-2019-17621 is a critical command execution vulnerability in the D-Link DIR-859's UPnP endpoint, /gena.cgi. An unauthenticated attacker who can reach the router's local network (or, in cases where UPnP is inadvertently exposed to the WAN, remotely) can send a specially crafted HTTP SUBSCRIBE request to the UPnP service to execute arbitrary system commands as root. CVSS 3.1 base score 9.8 (Critical).

Technical Details

This is CWE-78 (OS Command Injection). The gena.cgi script, part of the router's UPnP General Event Notification Architecture (GENA) implementation used for UPnP event subscriptions, fails to properly sanitize attacker-controlled fields in the SUBSCRIBE request before passing them into a system command. Because the UPnP service runs as root on the device's embedded Linux firmware, successful injection gives the attacker complete control over the router, without needing any credentials.

Discovery

The vulnerability was reported and D-Link published security advisory SAP10147 acknowledging the issue and directing customers to updated firmware for affected models.

Exploitation Context

CISA added CVE-2019-17621 to the KEV catalog in June 2023, and its required action calls for applying updates or discontinuing use if updates are unavailable. Vulnerable UPnP services on consumer routers like the DIR-859 are a long-standing target for IoT botnet operators (in the Mirai lineage), who scan for devices with UPnP reachable and exploit command-injection flaws like this one to recruit devices for DDoS attacks and other malicious activity.

Remediation

1. Apply the D-Link firmware update referenced in security advisory SAP10147 for the DIR-859, which resolves CVE-2019-17621.
2. If your specific hardware revision no longer receives updates, discontinue use and replace the device with a currently supported router.
3. Disable UPnP entirely if it is not required for your network's applications — this removes the vulnerable code path outright.
4. Ensure UPnP services are never exposed to the WAN/internet side of the router; UPnP is intended for LAN-only device discovery.
5. Monitor for signs of botnet recruitment (unexpected outbound traffic, high CPU/network usage) on any legacy D-Link router that cannot be immediately updated or replaced.