← Vulnerability feed

Vulnerability record · CVE-2019-19742 · published 18 December 2019

CVE-2019-19742: Dlink dir-615 firmware cross-site scripting vulnerability

Dlink · Dir 615 Firmware

On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.

4.8 CVSS 3.1 Medium EPSS 20% · top 2.7% CWE-79 · Cross-site scripting
4.8CVSS 3.1 base score, v2 3.5
20%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 6 tagged exploit
17 Jun 2026Last modified by NVD

Description

On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://infosecsanyam.blogspot.com/2019/12/d-link-dir-615-wireless-router.html ExploitThird Party Advisory
https://medium.com/%40infosecsanyam/d-link-dir-615-wireless-router-persistent-cross-site-scripting-6ee00f5c694d
https://pastebin.com/edit/MZV6DNg7 Broken Link
https://www.dlink.com/en/security-bulletin Vendor Advisory
https://www.exploit-db.com/exploits/47776 ExploitThird Party AdvisoryVDB Entry
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf ExploitThird Party AdvisoryUS Government Resource
https://infosecsanyam.blogspot.com/2019/12/d-link-dir-615-wireless-router.html ExploitThird Party Advisory
https://medium.com/%40infosecsanyam/d-link-dir-615-wireless-router-persistent-cross-site-scripting-6ee00f5c694d
https://pastebin.com/edit/MZV6DNg7 Broken Link
https://www.dlink.com/en/security-bulletin Vendor Advisory
https://www.exploit-db.com/exploits/47776 ExploitThird Party AdvisoryVDB Entry
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf ExploitThird Party AdvisoryUS Government Resource

Track CVE-2019-19742 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-16920D-Link router PingTest CGI command injection allows unauthenticated RCEMultiple D-Link router and powerline models expose a PingTest common gateway interface that passes arbitrary input into a system command without sani…KEVEPSS 100%analysed9.8CVE-2014-8361Realtek SDK miniigd SOAP service remote code executionThe miniigd SOAP service in the Realtek SDK fails to properly validate input in a NewInternalClient request, allowing remote code execution. The flaw…KEVEPSS 100%analysed10.0CVE-2018-25115Dlink dir-110 firmware os command injection vulnerabilityMultiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vuln…EPSS 10%9.8CVE-2021-42627D-Link DIR-615 WAN page exposed without authenticationThe WAN configuration page wan.htm on D-Link DIR-615 devices running firmware 20.06 is reachable directly without authentication. An unauthenticated …EPSS 63%analysed9.8CVE-2021-37388Dlink dir-615 firmware classic buffer overflow vulnerabilityA buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipaddr parameter in ping_response.cgi POST request allows an attacker to crash the webserver …EPSS 3.7%9.8CVE-2018-15839D-Link DIR-615 router buffer overflow via long Authorization headerD-Link DIR-615 firmware contains a memory buffer overflow (CWE-119) triggered by an overly long Authorization HTTP header. The flaw is remotely reach…EPSS 45%analysed8.8CVE-2019-17525Dlink dir-615 firmware improper restriction of authentication attempts vulnerabilityThe login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.EPSS 5.8%8.7CVE-2013-10050Dlink dir-300 firmware os command injection vulnerabilityAn OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authentica…EPSS 14%

Source: NIST National Vulnerability Database (record CVE-2019-19742), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.