CVE-2015-2051
D-Link DIR-645 Router Remote Code Execution Vulnerability
Description
CVE-2015-2051 is a CRITICAL command injection vulnerability in the D-Link DIR-645 Wired/Wireless Router, carrying a CVSS 3.1 score of 9.8. Classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), the vulnerability allows unauthenticated remote attackers to execute arbitrary commands by sending a specially crafted GetDeviceSettings action to the Home Network Administration Protocol (HNAP) interface. The device is end-of-life and D-Link recommends disconnecting affected routers from the network. This CVE was added to CISA's KEV catalog on February 10, 2022, with a remediation deadline of August 10, 2022. Firmware versions prior to 1.05b01 are affected. The EPSS score of 93.18% (99.80th percentile) reflects widespread exploitation, particularly by IoT botnets.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-645 firmware | < 1.05b01 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051(Exploit, Vendor Advisory)
- http://www.securityfocus.com/bid/72623(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/74870(Broken Link, Third Party Advisory, VDB Entry)
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282(Vendor Advisory)
- https://www.exploit-db.com/exploits/37171/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2051(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command
CVE-2015-2051 is classified under CWE-77 — Improper Neutralization of Special Elements used in a Command. This weakness occurs when user-controlled input is incorporated into system commands without proper sanitization, allowing command separator characters and shell metacharacters to inject additional commands.
In the D-Link DIR-645 router, the HNAP (Home Network Administration Protocol) interface processes incoming SOAP requests for device management. The GetDeviceSettings action handler fails to properly sanitize input parameters before passing them to system-level command execution functions. An attacker can inject shell commands through HNAP request headers, which the router executes with root-level privileges. This is particularly dangerous in consumer network equipment where the web management interface often runs as root.
Impact Analysis
CVE-2015-2051 carries a CVSS 3.1 base score of 9.8 (CRITICAL) with full impact on the compromised router.
Confidentiality (High): Command execution with root privileges on the router provides access to all configuration data including WiFi passwords, VPN credentials, DNS settings, connected device lists, and potentially traffic flowing through the router if the attacker sets up packet capture.
Integrity (High): Root-level access allows an attacker to modify DNS settings (redirecting traffic to malicious servers), alter firewall rules, change WiFi credentials, install persistent firmware modifications, and add the router to a botnet infrastructure.
Availability (High): The attacker can disable the router's network services, brick the device through firmware corruption, or consume bandwidth through botnet activities such as DDoS attacks and cryptocurrency mining.
No authentication required: The vulnerability is exploitable without any credentials (PR:N) and without user interaction (UI:N), enabling fully automated attacks.
IoT botnet context: Consumer routers like the DIR-645 are prime targets for IoT botnets. Once compromised, they are used for DDoS attacks, credential stuffing proxies, and as entry points into home and small business networks.
The EPSS score of 93.18% (99.80th percentile) reflects the heavy automated exploitation targeting this class of consumer network device.
Exploit Maturity
CVE-2015-2051 has a high exploit maturity with public exploits and widespread automated exploitation by IoT botnets.
Public exploits: Exploit code is available on Exploit-DB (37171) and the D-Link security advisory page itself references the exploitation details.
IoT botnet exploitation: This vulnerability has been incorporated into multiple IoT botnet frameworks that automatically scan the internet for vulnerable D-Link routers. Compromised devices are enrolled in botnets for DDoS attacks, proxy networks, and cryptomining.
KEV listing: CISA added CVE-2015-2051 to the KEV catalog on February 10, 2022. The required action explicitly states the product is end-of-life and should be disconnected.
Ransomware association: CISA's KEV does not indicate a direct ransomware association, but compromised routers can serve as network entry points for attacks against internal systems.
End-of-life status: The D-Link DIR-645 has reached end-of-life, meaning no further security patches will be released. This permanent vulnerability status makes all remaining devices perpetual targets.
EPSS context: The EPSS score of 93.18% (99.80th percentile) confirms extensive automated exploitation of this vulnerability.
Remediation
-
Disconnect and replace the D-Link DIR-645 router. The device is end-of-life and CISA's required action is to disconnect it from the network. Replace it with a currently supported router model that receives security updates.
-
Update firmware to 1.05b01 if replacement is not immediate. If the router must remain in use temporarily, update to the latest available firmware from D-Link support. Note that this may not fully address all security concerns in an EOL device.
-
Disable remote management and HNAP interface. If the router must remain in use, disable the HNAP interface and all remote management features accessible from the WAN side to reduce the attack surface.
-
Restrict administrative access to LAN only. Ensure the router's management interface is only accessible from the local network. Block all external access to management ports.
-
Monitor for compromise indicators. Check for unusual DNS settings, unexpected firewall rules, increased bandwidth usage, and connections to known botnet command-and-control servers.
-
Plan network equipment lifecycle management. Implement a policy for replacing network equipment before it reaches end-of-life to prevent permanent vulnerability exposure. Maintain an inventory of all network devices and their support status.
Technical Details
CVE-2015-2051 is a command injection vulnerability in the HNAP (Home Network Administration Protocol) interface of the D-Link DIR-645 router.
Attack vector and prerequisites: Network-based (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N). The attacker needs HTTP access to the router's HNAP interface, typically on port 80.
Exploitation mechanism: The HNAP interface processes SOAP requests for device management. The vulnerability exists in the handling of the GetDeviceSettings action. The SOAPAction header in the HTTP request is not properly sanitized before being used in a system command. An attacker can inject shell commands by including command separators (e.g., backticks, semicolons, or pipe characters) in the SOAPAction header value.
Root-level execution: The web server on the DIR-645 runs with root privileges, meaning injected commands execute as root. This grants the attacker complete control over the device, including the ability to modify firmware, change network configurations, and intercept traffic.
Affected firmware: D-Link DIR-645 firmware versions prior to 1.05b01. The device has since reached end-of-life with no further patches planned.
Attack surface: The HNAP interface is often accessible from both LAN and WAN, especially if remote management is enabled or if UPnP has exposed the management interface to the internet.
Frequently Asked Questions
What is CVE-2015-2051?
CVE-2015-2051 is a critical command injection vulnerability in the D-Link DIR-645 router's HNAP interface. It allows unauthenticated remote attackers to execute arbitrary commands with root privileges by sending crafted requests to the GetDeviceSettings action. The CVSS score is 9.8.
Is the D-Link DIR-645 still supported?
No. The D-Link DIR-645 has reached end-of-life and will not receive further security patches. CISA's required action for this vulnerability is to disconnect the device from the network. Users should replace it with a currently supported router model.
How do I fix CVE-2015-2051?
The recommended action is to replace the D-Link DIR-645 with a supported router. If immediate replacement is not possible, update firmware to version 1.05b01, disable remote management and HNAP access from WAN, and plan for device replacement as soon as feasible.
How severe is CVE-2015-2051?
CVE-2015-2051 is rated CRITICAL with a CVSS score of 9.8. The EPSS score of 93.18% places it in the 99.80th percentile. The vulnerability is actively exploited by IoT botnets, and the device's end-of-life status means it will remain permanently vulnerable. Any DIR-645 connected to the internet should be considered compromised.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.