Is the D-Link DIR-859 still getting security updates?
The D-Link DIR-859 stopped receiving security updates on 10 December 2020. New vulnerabilities will not be fixed.
The date after which a device gets no more security fixes is also called its end of life (EOL) or end of support.
Security updates ended on
10 December 2020What to do. Attackers are using known flaws in this model. Replace it. Until then, turn off remote administration and UPnP, and keep it off the Internet.
Vulnerabilities attackers are using
The U.S. cybersecurity agency (CISA) lists these vulnerabilities as actively exploited. Its description names the affected hardware versions when they are known.
- CVE-2019-17621: D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
- CVE-2024-0769: D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Support timeline
Questions
Is the D-Link DIR-859 still getting security updates?
The D-Link DIR-859 stopped receiving security updates on 10 December 2020. New vulnerabilities will not be fixed.
Is the D-Link DIR-859 affected by vulnerabilities attackers are using?
Yes. The CISA catalogue of exploited vulnerabilities lists CVE-2019-17621, CVE-2024-0769 for this model. Check the affected hardware versions and install the latest firmware, or replace the device if it is no longer supported.
What does end of life mean for the D-Link DIR-859?
After its end of life, the D-Link DIR-859 receives no more security fixes from D-Link. It keeps working, but any vulnerability found later stays open, which makes it an easy target once attackers know about it.
Where does this date come from?
From the manufacturer: D-Link | Legacy Products (Model / Last Day of Support). Each date is shown exactly as published.
Other D-Link routers
- DGL-3420ended 1 May 2012 Unsupported
- DGL-4100ended 5 November 2012 Unsupported
- DGL-4300ended 1 July 2010 Unsupported
- DGL-4500ended 5 May 2013 Unsupported
- DGL-5500ended 1 November 2017 Unsupported
- DI-514ended 1 August 2007 Unsupported
- DI-524ended 1 January 2009 Unsupported
- DI-604ended 1 June 2008 Unsupported
- DI-604UPended 29 December 2013 Unsupported
- DI-614+ended 1 March 2008 Unsupported
- DI-624ended 1 August 2010 Unsupported
- DI-624Mended 1 June 2008 Unsupported