LiveActive security incident?Get immediate response
CVE Record

CVE-2019-19742: On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.

On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2019-19742 is a blind cross-site scripting issue reported in D-Link DIR-615 routers. A malicious value in the account name field could affect someone who later views the router’s user account configuration page. The source bundle does not provide a CVSS score or confirmed patch status.

Executive priority

Treat this as a targeted router hardening issue, not an enterprise-wide emergency. Prioritize if DIR-615 devices are deployed, externally administered, shared across tenants, or unsupported.

Technical view

The CVE describes blind XSS on the D-Link DIR-615 User Account Configuration page through the name field. Public references include researcher writeups and Exploit-DB, but the bundle does not include affected firmware ranges, CVSS, CWE, or vendor fix details.

Likely exposure

Exposure is most likely on D-Link DIR-615 devices where untrusted or lower-trust users can reach the router management interface or account configuration workflow. The bundle does not identify specific firmware versions.

Exploitation context

The issue is publicly documented, including an Exploit-DB reference. However, CISA KEV status is false, and the provided sources do not state active exploitation in the wild.

Researcher notes

Evidence is incomplete for precise version scoping and remediation. The CVE description identifies DIR-615 and the vulnerable field, while references provide public technical context. Avoid assuming all DIR-615 firmware builds are affected without vendor or device-level confirmation.

Mitigation direction

  • Inventory D-Link DIR-615 routers and record firmware versions.
  • Check D-Link security guidance for firmware updates or lifecycle status.
  • Restrict router administration to trusted networks and administrators.
  • Disable remote management if it is enabled and not required.
  • Replace unsupported devices if no vendor-supported firmware is available.

Validation and detection

  • Confirm whether any DIR-615 devices exist in the environment.
  • Verify management interfaces are not exposed to untrusted networks.
  • Review router user/account fields for unexpected stored content.
  • Check vendor advisories against observed model and firmware versions.
  • Review administrative access logs where available.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-19742 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.