Deviceways

Router

D-Link DIR-859

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
A1
Get OpenWrt firmware Release listed · 25.12.6Get firmware Release listed · 25.12.5Open hardware record Release listed · 25.12.5
A3
Get OpenWrt firmware Release listed · 25.12.6Open hardware record Release listed · 25.12.5
Hardware revision not specified
Open hardware record
Original project github.com

A1

First installation
GUI OEM; D-Link Recovery GUI

A3

First installation
GUI OEM; D-Link Recovery GUI
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

d-link dir-859 a1 — device documentation (github.com)D-Link DIR-859 rev A1 — TechInfoDepot (github.com)D-Link DIR-859 rev A1 — WikiDevi (github.com)Device details — Source documentation (openwrt.org)

Hardware revision
A1

Device details

d-link dir-859 a3 — device documentation (github.com)Device details — Source documentation (openwrt.org)

Hardware revision
A3

OpenWrt · A1

OpenWrt · A1 — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM, D-Link Recovery GUI
Recovery routes recorded
D-Link Recovery GUI
Availability recorded by source
Discontinued

OpenWrt · A3

OpenWrt · A3 — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM, D-Link Recovery GUI
Recovery routes recorded
D-Link Recovery GUI
Availability recorded by source
Discontinued

Hardware differences

Technical references

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

Listed in CISA KEV ↗CVSS 9.8 (v3.1)

D-Link DIR-859

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a…

CVE-2019-17621

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

CVE-2019-17621 record (medium.com) ↗CVE-2019-17621 record (medium.com) ↗
CVE published

Listed in CISA KEV ↗CVSS 5.3 (v3.1)

DIR-859

D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal

CVE-2024-0769

Affected firmware
1.06B01
Fix
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Read VulDB CVE record
Details and sources
CVE updated

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVE-2024-0769 record (github.com) ↗
CVE published

CVSS 9.8 (v3.1)

D-Link DIR-859

A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication

CVE-2024-57045

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page.

CVE published

CVSS 9.8 (v3.1)

D-Link DIR-859

D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.

CVE-2022-46476

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.

CVE published

CVSS 8.8 (v3.1)

D-Link DIR-859

Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main

CVE-2023-36092

Affected firmware
Version scope unspecified in source
Fix
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Read mitre CVE record
Details and sources
CVE updated

Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Check more security advisories for this device · CVE.org