CVE-2015-2051

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 97,1%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada dlink dir-645 firmware. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 10 Februari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

Rincian

Terbit di NVD

23 Februari 2015

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

97,1% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

D-Link DIR-645 Router Remote Code Execution Vulnerability

Masuk KEV

10 Februari 2022

Tenggat CISA

10 Agustus 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

The impacted product is end-of-life and should be disconnected if still in use.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051 exploit · advisory vendor
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2051 pemerintah AS
• http://www.securityfocus.com/bid/72623 broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/74870 broken link · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/37171/ exploit · advisory pihak ketiga · vdb entry