High severity · published Mar 25, 2019
CVE-2019-7642
D-Link routers with the mydlink feature have some web interfaces without authentication requirements
7.5
CVSS
2.6%
EPSS
No
On KEV
Description
D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dir-816 Firmware · Dlink
2.06 · source: NVD
DF
Dir-816l Firmware · Dlink
2.06 · source: NVD
DF
Dir-817lw Firmware · Dlink
1.04 · source: NVD
DF
Dir-850l Firmware · Dlink
1.09 · source: NVD
DF
Dir-868l Firmware · Dlink
1.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7642
Exploit
https://github.com/xw77cve/CVE-2019-7642/blob/master/README.md
More from Dir-816 Firmware
9.8
CVE-2026-4184
A vulnerability was detected in D-Link DIR-816 1.10CNB05
9.8
CVE-2026-4183
A security vulnerability has been detected in D-Link DIR-816 1.10CNB05
9.8
CVE-2026-4182
A weakness has been identified in D-Link DIR-816 1.10CNB05
9.8
CVE-2026-4181
A security flaw has been discovered in D-Link DIR-816 1.10CNB05
9.8
CVE-2026-4180
A vulnerability was identified in D-Link DIR-816 1.10CNB05