CVE-2019-17506

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.

• CWE-306

• https://github.com/dahua966/Routers-vuls/blob/master/DIR-868/name%26passwd.pyExploit, Third Party Advisory
• https://github.com/dahua966/Routers-vuls/blob/master/DIR-868/name%26passwd.pyExploit, Third Party Advisory

Published

Oct 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1750A vulnerability in the Easy Virtual Switching System (VSS) o…7.4
• CVE-2019-17501Centreon 19.04 allows attackers to execute arbitrary OS comm…8.8
• CVE-2019-17502Hydra through 0.1.8 has a NULL pointer dereference and daemo…7.5
• CVE-2019-17503An issue was discovered in Kirona Dynamic Resource Schedulin…5.3
• CVE-2019-17504An issue was discovered in Kirona Dynamic Resource Schedulin…6.1
• CVE-2019-17505D-Link DAP-1320 A2-V1.21 routers have some web interfaces wi…7.5
• CVE-2019-17507An issue was discovered on D-Link DIR-816 A1 1.06 devices. A…7.5
• CVE-2019-17508On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/se…9.8
• CVE-2019-17509D-Link DIR-846 devices with firmware 100A35 allow remote att…9.8
• CVE-2019-1751A vulnerability in the Network Address Translation 64 (NAT64…8.6
• CVE-2019-17510D-Link DIR-846 devices with firmware 100A35 allow remote att…9.8
• CVE-2019-17511There are some web interfaces without authentication require…7.5