CVE DatabaseCVE-2015-2051

Updated 2026-06-17한국어 권고문 →

CVE-2015-20518.8/HIGHCISA KEVCWE-77CWE-77

D-Link DIR-645 Router HNAP Interface Remote Code Execution Vulnerability (CVE-2015-2051) Technical Advisory

⚡ Jump to Patch

Affected Vendors

d-link

Affected Components

dir-645

Published Date

2015-02-23

CVSS v3.1

8.8

HIGH

EPSS (30d)

97.1%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier

Impact

Unauthenticated remote attackers can execute arbitrary system commands with root privileges via a crafted GetDeviceSettings action to the HNAP interface

Mitigation

Disable remote management, block external access to the HNAP interface, and immediately replace the End-of-Life (EoL) device with a supported model

Affected Products & Version Scope

D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Because the D-Link DIR-645 router has reached its End-of-Life (EoL) cycle, the vendor does not provide official security patches for this vulnerability. The primary recommendation is to decommission the device. If immediate replacement is not possible, ensure the firmware is updated to the last available version as a temporary measure.

bash

# Note: DIR-645 is EoL. The following is a legacy manual upgrade reference.
# 1. Download the latest firmware binary from the official D-Link Support Portal.
# 2. Access the Router Web GUI -> Navigate to Tools -> Firmware.
# 3. Upload the downloaded firmware image to apply the update.

2. Temporary Workaround & Hardening Configuration

To mitigate the risk before replacing the hardware, disable Remote Management and block external access to the HTTP/HNAP port (TCP 80) using upstream firewall rules.

bash

# Block external access to the HNAP interface on an upstream Linux-based firewall
# Drop incoming TCP port 80 traffic containing the 'GetDeviceSettings' string
iptables -A FORWARD -i eth0 -p tcp --dport 80 -m string --string 'GetDeviceSettings' --algo bm -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP

3. Log Audit & IoC Verification Commands

Deploy the following Snort/Suricata signature to detect incoming exploitation attempts targeting the HNAP interface.

bash

# Snort/Suricata rule to detect CVE-2015-2051 exploitation attempts
alert tcp any any -> $HOME_NET 80 (msg:'EXPLOIT D-Link DIR-645 HNAP GetDeviceSettings RCE Attempt'; flow:established,to_server; content:'POST'; http_method; content:'/HNAP1/'; http_uri; content:'GetDeviceSettings'; nocase; reference:cve,2015-2051; classtype:attempted-admin; sid:1000001; rev:1;)

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Decommission the legacy D-Link DIR-645 router immediately and replace it with a modern, actively supported device.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2015-2051) is a critical Command Injection (CWE-77) vulnerability located within the Home Network Administration Protocol (HNAP) service of the D-Link DIR-645 router. The root cause lies in the insufficient sanitization of user-supplied input within the XML payload of the 'GetDeviceSettings' SOAP action. The router's internal web server processes these parameters and passes them directly to system command execution functions without proper validation.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request targeting the /HNAP1/ endpoint of the router. By embedding shell metacharacters (such as backticks '`' or semicolons ';') along with malicious payloads inside the XML structure of the 'GetDeviceSettings' request, the attacker forces the underlying operating system to execute arbitrary commands. Since the HNAP interface does not enforce authentication for this specific action, the exploit can be triggered remotely without any credentials.

3. Infrastructure & Business Impact

As a CISA KEV-listed vulnerability with an EPSS score of 0.971, this flaw is actively exploited in the wild, primarily by automated botnets to enlist vulnerable routers into DDoS infrastructure. Successful exploitation grants the attacker complete control over the router (root access), enabling lateral movement into the internal network, credential harvesting, DNS hijacking, and interception of sensitive network traffic.

Official Vendor Advisories & References

NVD Original English Description

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051

Source: cve@mitre.org · Exploit, Vendor Advisory

http://www.securityfocus.com/bid/72623

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

http://www.securityfocus.com/bid/74870

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282

Source: cve@mitre.org · Vendor Advisory

https://www.exploit-db.com/exploits/37171/

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Vendor Advisory

Frequently Asked SecOps Questions (CVE-2015-2051)

FAQ

Q1. How critical is CVE-2015-2051 and is it actively exploited in the wild?

CVE-2015-2051 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 97.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2015-2051?

Primary impacted vendors include d-link across dir-645. Scope summary: D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier

Q3. What temporary mitigations or workarounds exist for CVE-2015-2051 before patching?

[Mitigation] Disable remote management, block external access to the HNAP interface, and immediately replace the End-of-Life (EoL) device with a supported model Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION