GCVE - cpe:2.3:h:dlink:dir-859:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:dlink:dir-859:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Dlink (`b610c9ff-f722-5d9d-a6df-9bee7f4d4b44`)
Product	Dir 859 (`b1eada6a-9951-59bf-8d5d-a1ed04a63d57`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-0769`	not_vulnerable	2026-06-08 06:22:02.637667	D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal MEDIUM (5.3) UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Published: 2024-01-21T08:00:05.383Z Updated: 2025-10-21T23:05:27.747Z Open on db.gcve.eu Reference links https://vuldb.com/?id.251666 https://vuldb.com/?ctiid.251666 https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-36092`	not_vulnerable	2026-06-08 06:06:28.553626	Details available Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Published: 2023-07-31T00:00:00.000Z Updated: 2024-08-02T16:37:41.290Z Open on db.gcve.eu Reference links https://www.dlink.com/en/security-bulletin/ https://www.dlink.com/en/support	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25106`	not_vulnerable	2026-06-08 05:41:45.185539	Details available D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload. Published: 2022-03-04T19:20:01.000Z Updated: 2024-08-03T04:29:01.837Z Open on db.gcve.eu Reference links https://www.dlink.com/en/security-bulletin/ https://github.com/chunklhit/cve/blob/master/dlink/DIR859/BufferOverflow.md https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10267	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20217`	not_vulnerable	2026-06-08 05:13:30.601359	Details available D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. Published: 2020-01-29T02:32:38.000Z Updated: 2024-08-05T02:39:08.909Z Open on db.gcve.eu Reference links https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 https://medium.com/%40s1kr10s/d-link-dir-859-rce-unauthenticated-cve-2019-20216-cve-2019-20217-en-6bca043500ae https://medium.com/%40s1kr10s/d-link-dir-859-rce-unauthenticated-cve-2019-20216-cve-2019-20217-es-e11ca6168d35	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20216`	not_vulnerable	2026-06-08 05:13:30.600957	Details available D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. Published: 2020-01-29T02:28:32.000Z Updated: 2024-08-05T02:39:10.054Z Open on db.gcve.eu Reference links https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 https://medium.com/%40s1kr10s/d-link-dir-859-rce-unauthenticated-cve-2019-20216-cve-2019-20217-en-6bca043500ae https://medium.com/%40s1kr10s/d-link-dir-859-rce-unauthenticated-cve-2019-20216-cve-2019-20217-es-e11ca6168d35	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20215`	not_vulnerable	2026-06-08 05:13:30.600497	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20213`	not_vulnerable	2026-06-08 05:13:30.584312	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-17621`	not_vulnerable	2026-06-08 05:13:10.850469	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.