high8.8Known exploitedPublic exploit code
CVE-2015-2051
D-Link DIR-645 Router Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-02-10. Federal due date: 2022-08-10.
The impacted product is end-of-life and should be disconnected if still in use.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- D-Link Devices - HNAP SOAPAction-Header Command Execution (Metasploit)2015-06-01 · remote · hardware · Verified
Impact
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dlink | Dir-645 Firmware | before 1.05b01 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051
- http://www.securityfocus.com/bid/72623
- http://www.securityfocus.com/bid/74870
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282
- https://www.exploit-db.com/exploits/37171/
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051
- http://www.securityfocus.com/bid/72623
- http://www.securityfocus.com/bid/74870
- https://www.exploit-db.com/exploits/37171/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2051