Security readout for executives and security teams
Plain-English summary
CVE-2019-10891 is a critical command-injection flaw reported in D-Link DIR-806 devices. A remote attacker may be able to make the device run operating-system commands through a specially crafted HTTP header. For executives, the concern is full compromise of vulnerable routers if exposed and unremediated.
Executive priority
Prioritize this as urgent for any exposed DIR-806 device. The vulnerability allows potential full device compromise without authentication, and routers often sit at network boundaries. If no DIR-806 assets are present, record that finding and move to normal monitoring.
Technical view
The CVE describes CWE-78 command injection in the DIR-806 hnap_main function. It calls system() without validating a user-controlled parameter supplied through an HTTP header, enabling remote arbitrary shell command execution. The CVSS 3.1 score is 9.8 with network attack vector, low complexity, no privileges, and no user interaction.
Likely exposure
Exposure is likely limited to D-Link DIR-806 devices, but the provided CVE affected-product metadata lists vendor, product, and versions as n/a. Organizations should verify whether DIR-806 hardware exists in inventories and whether its HTTP management surface is reachable from untrusted networks.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. A public researcher reference exists, and the CVE description states remote attack is possible using a special HTTP header. Treat internet-reachable devices as high risk, but do not claim confirmed exploitation from these sources.
Researcher notes
Evidence is strongest for vulnerability class, affected device family, and CVSS severity. It is weaker for exact affected versions, vendor fix details, and exploitation in the wild because those details are not present in the provided bundle. Avoid extrapolating beyond DIR-806 without vendor confirmation.
Mitigation direction
- Inventory D-Link DIR-806 devices and prioritize internet-reachable units.
- Review D-Link SAP10282 for supported firmware, retirement, or replacement guidance.
- Remove untrusted network access to router management interfaces where possible.
- Restrict administration to trusted networks or VPN access only.
- Replace unsupported devices if no vendor-supported remediation is available.
Validation and detection
- Confirm whether any DIR-806 devices exist in asset inventory.
- Check perimeter scans for exposed DIR-806 management services.
- Review firmware and support status against D-Link SAP10282.
- Verify management access is restricted from untrusted networks.
- Document remediation status for each identified device.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-10891 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.