# CVE-2024-0769: D-Link DIR-859 - Path Traversal

> Live exploitation tracking for CVE-2024-0769 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-0769

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** D-Link DIR-859
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** firewall

## Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

## CrowdSec analysis

[CVE-2024-0769](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-0769) is a vulnerability in D-Link DIR-859 devices that allows remote attackers to carry out path traversal attacks through crafted requests to the `/hedwig.cgi` endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 28th of June 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-0769 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-0769 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Observed exploitation attempts typically target URLs ending with `/hedwig.cgi`.

## Timeline

- 2024-01-21: CVE Published. CVE-2024-0769 is published to NVD.
- 2024-06-28: Rule Released. CrowdSec releases a rule to detect CVE-2024-0769 exploitation attempts against the CrowdSec Network.
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-0769 for the first time.
- 2025-06-25: CISA KEV. CVE-2024-0769 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-07-16: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://vuldb.com/?id.251666
- https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-0769) follows observed exploitation activity for CVE-2024-0769. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.