CVE-2024-0769

D-Link DIR-859 Router Path Traversal

5.3 MEDIUMActively exploited (CISA KEV)Public exploitEPSS 82.7%

Published21 Jan 2024
Added to CISA KEV25 Jun 2025
Remediation due16 Jul 2025

D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

Added to KEV: 25 Jun 2025Federal remediation due: 16 Jul 2025

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityLow

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

D-Link Dir-859 Firmware1.06

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371

References

https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.mdExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-0769US Government Resource
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371Vendor Advisory
https://vuldb.com/?ctiid.251666Permissions RequiredVDB Entry
https://vuldb.com/?id.251666Third Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0769US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-0769 being actively exploited?

Yes. CVE-2024-0769 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Jun 2025.

How severe is CVE-2024-0769?

CVE-2024-0769 has a CVSS 3.1 base score of 5.3, rated medium. EPSS estimates a 82.7% probability of exploitation.

Which products are affected by CVE-2024-0769?

Affected products include D-Link Dir-859 Firmware.

How do I fix CVE-2024-0769?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-0769 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.