CVE-2026-2151
OS Command Injection in D-Link DIR-615 DMZ Host Feature
Publication date: 2026-02-08
Last updated on: 2026-02-11
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-615_firmware | 4.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'This vulnerability exists in the D-Link DIR-615 router, version 4.10, specifically in the adv_firewall.php file related to the DMZ Host feature.'}, {'type': 'paragraph', 'content': "It occurs because the router's web interface improperly handles the dmz_ipaddr parameter, which is used to configure firewall rules."}, {'type': 'paragraph', 'content': 'An attacker with administrative access can inject arbitrary operating system commands into this parameter due to lack of input sanitization, leading to OS command injection.'}, {'type': 'paragraph', 'content': 'These injected commands are executed with root privileges on the device, allowing full control over the router.'}] [1, 2]
How can this vulnerability impact me? :
Exploitation of this vulnerability can compromise the confidentiality, integrity, and availability of the affected device.
- An attacker can execute arbitrary commands with root privileges, potentially taking full control of the router.
- This can lead to unauthorized access to network traffic, disruption of network services, or use of the device as a foothold for further attacks.
- Since the device is no longer supported by the vendor, no patches or fixes are available, increasing the risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability affects the D-Link DIR-615 router running firmware version 4.10, specifically the adv_firewall.php page related to the DMZ Host feature. Detection can involve checking for the presence of this device and firmware version on your network.'}, {'type': 'paragraph', 'content': 'One method to identify potentially vulnerable devices is to search for the URL path "adv_firewall.php" on devices accessible on your network or via internet scanning tools.'}, {'type': 'paragraph', 'content': 'Google Dorking can be used externally with the query: inurl:adv_firewall.php to find exposed devices.'}, {'type': 'paragraph', 'content': 'Since exploitation requires authenticated access, verifying if unauthorized users have administrative access to the router is critical.'}, {'type': 'paragraph', 'content': 'No specific detection commands are provided in the resources, but network scanning tools like nmap can be used to identify D-Link DIR-615 devices, and manual inspection of the web interface for the presence of the DMZ Host feature and firmware version 4.10 can help confirm vulnerability.'}] [2, 1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Since the affected product is no longer supported by the vendor and no patches or countermeasures are available, immediate mitigation options are limited.'}, {'type': 'paragraph', 'content': 'The recommended action is to replace the vulnerable D-Link DIR-615 router with a supported alternative device that receives security updates.'}, {'type': 'paragraph', 'content': "In the short term, restrict administrative access to the router's web interface to trusted networks and users only, to prevent remote exploitation."}, {'type': 'paragraph', 'content': 'Disable the DMZ Host feature if it is enabled, as this is the component involved in the vulnerability.'}, {'type': 'paragraph', 'content': 'Monitor network traffic for suspicious activity that could indicate exploitation attempts.'}] [2, 1]