Vulnerability record · CVE-2019-20215 · published 29 January 2020
CVE-2019-20215: D-Link DIR-859 ssdpcgi OS command injection via M-SEARCH urn
Dlink · Dir 859 Firmware
D-Link DIR-859 firmware 1.05 and 1.06B01 Beta01 mishandle the HTTP_ST value in ssdpcgi() in /htdocs/cgibin, allowing OS command injection. The urn: service/device value is checked with strstr, so shell metacharacters can be used to append arbitrary commands. This is a critical, remotely reachable flaw in a consumer router.
Description
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote OS command execution with CVSS 9.8 and very high EPSS on an internet-exposed consumer router.
What it is
D-Link DIR-859 firmware 1.05 and 1.06B01 Beta01 mishandle the HTTP_ST value in ssdpcgi() in /htdocs/cgibin, allowing OS command injection. The urn: service/device value is checked with strstr, so shell metacharacters can be used to append arbitrary commands. This is a critical, remotely reachable flaw in a consumer router.
Impact
An unauthenticated remote attacker can execute arbitrary OS commands on the device, gaining full control of the router and any traffic or credentials passing through it.
Attack surface
Reachable over the network via an M-SEARCH request to the SSDP handling path; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.751, ~99.5th percentile), and public exploit write-ups exist in the references, indicating active interest and likely weaponization.
What to do
- Apply the D-Link vendor advisory SAP10147 firmware fix for DIR-859; if no fixed firmware is available, replace or retire the device.
- Disable or block SSDP/UPnP exposure on the WAN and restrict the router management and SSDP ports to trusted LAN segments only.
- Segment IoT and router management traffic away from critical systems, and place the device behind a firewall that drops inbound SSDP/M-SEARCH from untrusted networks.
- Monitor D-Link advisories for end-of-support status and remove unsupported devices from production networks.
Detection
- Inspect HTTP/SSDP M-SEARCH requests for urn: values containing shell metacharacters (;, |, $(), backticks) in HTTP_ST.
- Alert on unexpected outbound connections or command execution artifacts from the router's management IP.
- Review router logs for anomalous ssdpcgi or cgibin activity and repeated M-SEARCH requests from external sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-20215 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-20215), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
