CVE-2019-7298

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.08.1High EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2019-02-01Updated 2024-11-21Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Dlink Dir-823g FirmwareAffected: ≤ 1.02b03Upgrade to: after 1.02b03Stated by: NVD
D-Link Corp. DIR-823GAffected: 1.02B03Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your D-Link DIR-823G firmware version and confirm it is 1.02B03 or earlier.
If the device is on your network, restrict who can reach the router management interface (limit access to your internal network only, not the public internet).
Update/reflash to a firmware version newer than 1.02B03 as soon as a fixed version is available from D-Link.
If you cannot update immediately, keep the router management interface inaccessible from the internet until you patch.

Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body, such as a body of ' /bin/telnetd' for the GetDeviceSettingsset API function. Consequently, an attacker can execute any command remotely when they control this input.

In plain language

Written by AI from the record

CVE-2019-7298 is a serious remote “command injection” flaw in D-Link DIR-823G routers (firmware 1.02B03 or older) that lets an attacker run commands on the router without an account; if your router is exposed to the network, you should act.

In D-Link DIR-823G routers running firmware through 1.02B03, attackers with network access can exploit an unauthenticated command injection in the /HNAP1 request handling to execute arbitrary operating system commands remotely without any login.

If you're affected

Full router takeover
Network traffic interception
Data theft risk
Service disruption

What is it

This vulnerability is like leaving a back door keyhole on your router’s management page. If someone can reach that page, they can send a special message that tricks the router into running operating system commands, which can fully compromise the device.

Who is affected

This matters if you use a D-Link DIR-823G router with firmware version 1.02B03 or older. The issue is reachable over the network in default configuration and does not require an account, so attackers only need network access to the router. The risk is highest if the router management interface is reachable from outside your network; otherwise, it’s much less likely to be exploited.

How urgent is it

This should be treated as urgent because attackers can execute operating system commands on the router without an account, and the flaw is reachable in the default configuration. Public proof-of-concept exists, and press attention is rising, so waiting increases the chance of being targeted.

What to do — in detail

Confirm exposure

Identify the affected device: D-Link DIR-823G.
Check the installed firmware version on the router UI or device status page.
Determine whether the router’s management interface is reachable from the network that an attacker could access (especially the public internet).
- The findings state the attack is reachable in default configuration and requires no authentication.

Remediate (preferred)

Obtain and install a D-Link firmware update that is newer than 1.02B03 (the fix is described as a vendor firmware remediation, but no fixed version number was provided in the findings).
After updating, verify the firmware version changed and re-test that the management interface is only reachable as intended.

If patching is delayed (workaround)

Restrict access to the router management interface immediately:
- Ensure it is not exposed to the internet.
- Limit access to trusted internal IPs only (e.g., your office network/subnet), if remote admin is not required.
Keep the router updated and plan to replace/upgrade once a fixed firmware is available.

What to monitor

Unusual router behavior (unexpected reboots, changes to settings, new admin accounts if your model supports it).
Router logs for requests to the HNAP endpoint (/HNAP1), especially from unexpected source IPs.
Network symptoms that suggest traffic tampering (clients losing connectivity, DNS changes, or unexpected routing behavior).

CISA due date

Not listed in the CISA KEV findings provided, so no specific CISA due date is included here.

Technical context

Severity is high: the router can be forced to run arbitrary operating system commands remotely. The weakness is CWE-78 (Command Injection). The attack vector is network-based and does not require authentication (no login) and requires no user interaction. Exploitation is performed by sending a crafted /HNAP1 request that causes the HNAP API handling to call a system function with attacker-controlled input from the request body; for example, an attacker can supply input that effectively triggers execution of attacker-chosen commands. The findings state a public proof-of-concept exists on GitHub (1 known) and that press attention is rising; KEV listing was not found in the provided findings. EPSS is listed as predicted likelihood (trend: falling), but since KEV/news are not included as exploitation confirmation here, this writeup does not rely on EPSS for urgency. Verdict for this CVE is AMBER.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-28EPSS band changemoderate → 0epss band change

Affected products

D-Link Corp.commercial · TWaka dlink, d-link corporation, d-link international
- DIR-823GNetworking Infrastructure
- dir-823g firmwareNetworking Infrastructure

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable