D-Link DIR-859 - Path Traversal (CVE-2024-0769)
Description
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
psychologyCrowdSec Analysis
CVE-2024-0769 is a vulnerability in D-Link DIR-859 devices that allows remote attackers to carry out path traversal attacks through crafted requests to the /hedwig.cgi endpoint.
CrowdSec has been tracking this vulnerability and its exploits since 28th of June 2024.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-0769 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-0769 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Observed exploitation attempts typically target URLs ending with /hedwig.cgi.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-01-21 |
| Rule Released | 2024-06-28 |
| CrowdSec First Seen | 2024-11-23 |
| CISA KEV | 2025-06-25 |
| CISA Remediation Deadline | 2025-07-16 |