D-Link DIR-859 (DIR-859)

D-Link DIR-859 (DIR-859)
Security Grade F Calculator v	D-Link DIR-859 (DIR-859) Brand: D-Link Category: Router • Model / Gen: DIR-859 Release Date: 2016-01-01 • Status: End of life Classification Date:

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	—	Routers expose internal UART/JTAG headers and have no physical tamper resistance.
Known vulnerabilities	Very common	—	CVE-2019-17621 (UPnP command injection), CVE-2019-20213/20215/20216/20217 — 12+ CVEs. Source: nvd.nist.gov/vuln/detail/CVE-2019-17621
Prior attacks	Very common	—	CVE-2019-17621 is in CISA's KEV catalog; exploited in the wild. Source: supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
Updatability	None	—	The DIR-859 is end-of-life — D-Link no longer ships firmware; CISA recommends discontinuing use. Source: www.cisa.gov/known-exploited-vulnerabilities-catalog
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—	UPnP/WPS and the vulnerable /gena.cgi endpoint accept unauthenticated requests. Source: nvd.nist.gov/vuln/detail/CVE-2019-17621
Communications	Encrypted with obselete encryption	—	Administration is plain HTTP by default; WPA2 on Wi-Fi; obsolete TLS where present.
Storage	No encryption	—	Configuration and credentials stored in plaintext flash; no encryption at rest.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Basic	—	Single admin account with no granular roles.
Authentication	Basic	—	Username/password only; several models shipped with hardcoded/default credentials.
Brute-force protection	Absent	—	No login rate-limiting; admin interface is brute-forceable.
Event logging	Partial logging	—	Basic syslog-style logging only.
Passwords	Default/Common/Easy to guess	—	Default 'admin'/'blank' credentials are common and often left unchanged. Source: supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
Category Score	Score: 3 / 3