CVE-2019-7642

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-03-25 · updated 2026-06-17
Weakness: CWE-306

Description

D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10).

Affected products

D-Link DIR-816: 2.06
D-Link DIR-816L: 2.06
Dlink Dir-817Lw Firmware: 1.04
D-Link DIR-850L and potentially others: 1.09
D-Link DIR-868L: 1.10

References

https://github.com/xw77cve/CVE-2019-7642/blob/master/README.md
https://github.com/xw77cve/CVE-2019-7642/blob/master/README.md

Get alerted when CVE-2019-7642 or the next vulnerability affects your stack