{"id":"CVE-2019-7390","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-7390","generatedAt":"2026-10-27T22:24:56.943Z","title":"There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API.","description":"An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API.","published":"2019-02-05T00:29:00.000Z","lastModified":"2026-06-17T02:40:33.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":8.6,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"},"cwe":["CWE-306"],"affected":["dlink/dir-823g firmware"],"epss":{"score":0.01963,"percentile":0.80202,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/106855","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/leonW7/D-Link/blob/master/Vul_5.md","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/106855","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/leonW7/D-Link/blob/master/Vul_5.md","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-7390","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}