GCVE - cpe:2.3:o:dlink:dir-859_firmware:1.05:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:dlink:dir-859_firmware:1.05:*:*:*:*:*:*:*

part: o version: 1.05 update: *

Vendor	Dlink (`b610c9ff-f722-5d9d-a6df-9bee7f4d4b44`)
Product	Dir 859 Firmware (`0ca80c02-d0b7-5f79-bd09-9a92a7d94414`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-25106`	vulnerable	2026-06-08 05:41:45.184355	Details available D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload. Published: 2022-03-04T19:20:01.000Z Updated: 2024-08-03T04:29:01.837Z Open on db.gcve.eu Reference links https://www.dlink.com/en/security-bulletin/ https://github.com/chunklhit/cve/blob/master/dlink/DIR859/BufferOverflow.md https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10267	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20217`	vulnerable	2026-06-08 05:13:30.601316	Details available D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. Published: 2020-01-29T02:32:38.000Z Updated: 2024-08-05T02:39:08.909Z Open on db.gcve.eu Reference links https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 https://medium.com/%40s1kr10s/d-link-dir-859-rce-unauthenticated-cve-2019-20216-cve-2019-20217-en-6bca043500ae https://medium.com/%40s1kr10s/d-link-dir-859-rce-unauthenticated-cve-2019-20216-cve-2019-20217-es-e11ca6168d35	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20216`	vulnerable	2026-06-08 05:13:30.600913	Details available D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. Published: 2020-01-29T02:28:32.000Z Updated: 2024-08-05T02:39:10.054Z Open on db.gcve.eu Reference links https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 https://medium.com/%40s1kr10s/d-link-dir-859-rce-unauthenticated-cve-2019-20216-cve-2019-20217-en-6bca043500ae https://medium.com/%40s1kr10s/d-link-dir-859-rce-unauthenticated-cve-2019-20216-cve-2019-20217-es-e11ca6168d35	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20215`	vulnerable	2026-06-08 05:13:30.599562	Details available D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. Published: 2020-01-29T02:23:26.000Z Updated: 2024-08-05T02:39:09.180Z Open on db.gcve.eu Reference links https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-rce-in-ssdpcgi-http-st-cve-2019-20215-en-2e799acb8a73 http://packetstormsecurity.com/files/156250/D-Link-ssdpcgi-Unauthenticated-Remote-Command-Execution.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.