CVE-2019-17506: D-Link DIR-868L and DIR-817LW routers expose credentials via unauthenticated getcfg.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, and the flaw directly discloses administrative credentials for the device.

What it is

The D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers expose web interfaces that require no authentication. By requesting a DEVICE.ACCOUNT value for SERVICES with AUTHORIZED_GROUP=1%0a against getcfg.php, an attacker can retrieve the router's username and password along with other information. Because the credentials grant administrative control, this is a serious exposure for any internet-reachable device.

Impact

An attacker obtains the router's administrative username and password, which can then be used to control the router remotely, including changing its configuration and intercepting or redirecting traffic.

Attack surface

Reachable over the network through the router's web interface; the CVSS vector shows AV:N/PR:N/UI:N, so no authentication and no user interaction are required. Any host that can reach the router's HTTP service can attempt the request.

Exploitation

No CISA KEV listing and no ransomware associations are recorded, but EPSS is 0.56386 (99th percentile) and the references include a public exploit script tagged Exploit, indicating public exploitation tooling exists.

What to do

• Apply the vendor firmware update for DIR-868L B1 and DIR-817LW A1 if one is available; if no fix exists, retire or replace the affected devices.
• Remove the router's web management interface from internet exposure; restrict administration to the LAN and trusted management networks.
• Change the router administrator password and any reused credentials immediately, since the flaw discloses stored credentials.
• Disable remote management and UPnP or other WAN-facing services that are not strictly required.
• Segment or isolate the router on the network and monitor for unauthorized configuration changes.

Detection

• Search web or proxy logs for requests to getcfg.php containing AUTHORIZED_GROUP=1 or DEVICE.ACCOUNT parameters.
• Alert on unauthenticated access to router management endpoints from external or unexpected source addresses.
• Monitor router configuration and account changes for signs of unauthorized administrative activity.
• Inventory for DIR-868L B1-2.03 and DIR-817LW A1-1.04 firmware versions and flag any that remain internet-reachable.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.