PT-2015-1277 · D Link · D-Link Dir-645

Craig Heffner + 1 · Published 2015-02-23 · Updated 2026-06-08 · CVE-2015-2051

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-645 Wired/Wireless Router Rev. Ax versions prior to 1.04b12

Description The HNAP (Home Network Administration Protocol) interface fails to properly neutralize special characters used in OS commands. This allows remote attackers to execute arbitrary commands via a 'GetDeviceSettings' action. In real-world incidents, the Goldoon botnet has exploited this issue to gain full control over devices, extract data, and establish communication with Command and Control (C&C) servers to launch DDoS attacks across 27 different vectors using DNS, HTTP, ICMP, TCP, and UDP protocols.

Recommendations Update the firmware to a version later than 1.04b12. As a temporary workaround, restrict access to the HNAP interface to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2015-10307

CVE-2015-2051

Affected Products

D-Link Dir-645

References · 33

• 🔥 https://exploit-db.com/exploits/37171 · Exploit
• 🔥 http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2051 · Security Note
• https://bdu.fstec.ru/vul/2015-10307 · Security Note
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282 · Vendor Advisory
• https://twitter.com/gothburz/status/1873602511086469454 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2051 · Note
• https://t.me/aptreports/1590 · Telegram Post
• https://twitter.com/catnap707/status/1873862566000419098 · Twitter Post
• https://t.me/nekaspersky/2117 · Telegram Post
• https://t.me/aptreports/9605 · Telegram Post
• https://twitter.com/DuneSecurity/status/1872655282050084927 · Twitter Post
• https://t.me/aptreports/2098 · Telegram Post
• https://twitter.com/arunpratap786/status/1872348395790082405 · Twitter Post
• https://t.me/cvenotify/109851 · Telegram Post