CVE-2024-0769 D-Link DIR-859 Router Path Traversal
Remote attackers can exploit a path traversal vulnerability in the D-Link DIR-859 router to read arbitrary files, requiring replacement of the end-of-life device.
- Exploited in the wild
- Since 25 Jun 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0769?
CVE-2024-0769 is a medium-severity path traversal vulnerability in D-Link DIR-859, published on 21 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Weakness: CWE-22
Which versions are affected by CVE-2024-0769?
It affects 1 product.
Products include Dlink Dir-859 Firmware.
How do I fix CVE-2024-0769?
No fix has been published for CVE-2024-0769 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 16 Jul 2025.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-0769 being exploited?
Yes. Attackers have exploited CVE-2024-0769 in the wild since at least 25 Jun 2025.
Other vulnerabilities in D-Link DIR-859
Sources
Also known as GHSA-w828-74x3-f6hx.