CVE-2019-19597

HIGH EXPLOITED IN THE WILD

D-Link DAP-1860 <v1.04b03 Beta - RCE

Title source: llm

Exploitation Summary

CVE-2019-19597 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10135

Exploit, Third Party Advisory x_refsource_misc

https://chung96vn.wordpress.com/2019/11/15/d-link-dap-1860-vulnerabilities/

Scores

CVSS v3 8.8

EPSS 0.1122

EPSS Percentile 93.6%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2021-04-12

InTheWild.io 2021-04-12

CWE

CWE-863

Status published

Products (3)

dlink/dap-1860_firmware 1.01b06

dlink/dap-1860_firmware 1.02b01

dlink/dap-1860_firmware 1.04b01

Published Dec 05, 2019

Tracked Since Feb 18, 2026