CVE-2015-2051highunder attackCWE-77

CVE-2015-2051

Published · Updated

Follow this CVE+ Monitor DIR-645 Router

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 97%
from disclosure to weapon98 days
Published on NVDFeb 23
1st PoC+98d
metasploitFeb 13
CISA KEV+2544d
Action required by CISAfederal deadline: 2022-08-10

The impacted product is end-of-life and should be disconnected if still in use.

In short

A flaw in D-Link DIR-645 routers allows attackers to run any command they want by sending specially crafted requests to the router's HNAP interface. This is dangerous because attackers can take full control of the router without needing to log in first.

Technical detail

The HNAP interface in D-Link DIR-645 firmware 1.04b12 and earlier fails to properly validate or sanitize the GetDeviceSettings action, enabling unauthenticated remote command injection. An attacker can send a malicious HNAP request to execute arbitrary system commands with router privileges, leading to complete device compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.