CVE-2024-0769: D-Link DIR-859 path traversal in hedwig.cgi

CVE-2024-0769 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-06-25

A vulnerability exists in legacy D-Link DIR-859 routers, which are used to provide internet connectivity and network management for homes and small offices. An attacker can remotely access sensitive configuration files and session data, potentially leading to full control of the device. Because these routers have reached end-of-life status, no security patches will be released, and the manufacturer recommends replacing the hardware immediately.

Vendors: D-Link.

Quick answers

Is CVE-2024-0769 exploited in the wild?
Yes. CVE-2024-0769 is known to be exploited in the wild, first recorded on 25 June 2025. Treat it as urgent.
How severe is CVE-2024-0769?
Critical severity, with a CVSS score of 9.8, published 25 June 2025.
Which products and versions are affected?
D-Link Dir-859 Router 1.06B01 and all legacy versions.
Is there a fix for CVE-2024-0769?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-0769 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-0769?
Check whether you run D-Link DIR-859 or D-Link Dir-859 Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the /hedwig.cgi file of the D-Link DIR-859 router's HTTP POST Request Handler. By manipulating the 'service' argument with traversal sequences (e.g., ../../../../), a remote, unauthenticated attacker can read arbitrary files from the filesystem, such as DHCPS6.BRIDGE-1.xml. This can lead to the exposure of session data and administrative credentials, facilitating privilege escalation and full device compromise. The vulnerability is confirmed to be exploited in the wild, and since the product is End-of-Life (EOL), no official patch is available; users are advised to retire the hardware.

Affected products

  • D-Link DIR-859 Router 1.06B01 and all legacy versions

Timeline

  • 2024-01-21: disclosed: Initial vulnerability report via VulDB
  • 2024-01-29: advisory: NIST NVD analysis published
  • 2025-06-25: kev added: CISA added to Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.