CVE-2019-20213

—

CVSS 3.1

7.5 high

EPSS

2%p81

Published

Jan 2, 2020 (Jan 2, 2020)

Modified

Jun 17, 2026

Description

D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.

Vendors: dlink
Products: dir-859 firmware, dir-822 firmware, dir-823 firmware, dir-865l firmware, dir-868l firmware, dir-869 firmware, dir-880l firmware, dir-890l firmware, dir-890r firmware, dir-885l firmware, dir-885r firmware, dir-895l firmware
Weakness: CWE-74, CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.2%)

In the news1 stories

RCE and Information disclosure flaws affect dozens of D

Security AffairsJan 3, 08:18 UTC · Jan 3, 2020Vulnerability CVE-2019-17621 CVE-2019-20213