CVE-2026-19893

Deferred Deferred - Pending Action

Incorrect Default Permissions in D-Link DIR-842 via vsftpd Configuration

Publication date: 2026-08-15

Last updated on: 2026-08-20

Assigner: VulDB

Description

A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-20

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-19893

EUVD

EUVD-2026-59743

Affected Vendors & Products

Vendor	Product	Version / Range
d-link	dir-842	2.01.b04

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-276	During installation, installed file permissions are set to allow anyone to modify those files.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects D-Link DIR-842 version 2.01.B04 due to incorrect default permissions in the vsftpd configuration file (/etc/vsftpd.conf). The issue allows remote attackers to manipulate the file, though the attack requires high complexity and is difficult to exploit.

Detection Guidance

This vulnerability involves incorrect default permissions in /etc/vsftpd.conf on D-Link DIR-842 2.01.B04. Check the file permissions with 'ls -l /etc/vsftpd.conf' and verify if they deviate from expected secure settings. Inspect vsftpd configuration for misconfigured permissions or unauthorized access.

Impact Analysis

The vulnerability could allow unauthorized changes to vsftpd configuration, potentially leading to unintended access or service disruptions. However, the high attack complexity and difficulty reduce the likelihood of exploitation.

Compliance Impact

The vulnerability involves incorrect default permissions in D-Link DIR-842 firmware, potentially allowing unauthorized access. This could impact compliance with GDPR or HIPAA by risking unauthorized data exposure or modification, though specific compliance impacts depend on system configuration and data handling.

Mitigation Strategies

Update the D-Link DIR-842 firmware to the latest version to address the incorrect default permissions in /etc/vsftpd.conf. Disable remote access to vsftpd if not required and restrict permissions to sensitive files.

Hi! I’m here to help you understand CVE-2026-19893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70