CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2019-20213
D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
Severity
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-74, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dlink:dir-818lx_firmware
- dlink:dir-822_firmware
- dlink:dir-823_firmware
- dlink:dir-859_firmware
- dlink:dir-865l_firmware
- dlink:dir-868l_firmware
- dlink:dir-869_firmware
- dlink:dir-880l_firmware
- dlink:dir-885l_firmware
- dlink:dir-885r_firmware
- dlink:dir-890l_firmware
- dlink:dir-890r_firmware
- dlink:dir-895l_firmware
- dlink:dir-895r_firmware
References
- https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-en-faf1a9a13f3f
- https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-es-6540f7f55b03
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147
- https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-en-faf1a9a13f3f