CVE-2015-2051: D-Link DIR-645 Router HNAP Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is remotely exploitable without authentication, has public exploit code, is listed in CISA KEV, and carries a near-certain EPSS score, making it an urgent risk for any device still in service.

What it is

The D-Link DIR-645 wired/wireless router (Rev. Ax, firmware 1.04b12 and earlier) fails to sanitize input to the HNAP interface, allowing command injection through a GetDeviceSettings action. Because the flaw permits arbitrary command execution on the device, it exposes the router and everything behind it to full compromise.

Impact

An attacker can execute arbitrary commands on the router with the privileges of the affected service, gaining control of the device and a foothold on the network. This can lead to traffic interception, credential theft, and lateral movement into connected systems.

Attack surface

The vulnerability is reached over the network via the router's HNAP interface, which is exposed on the adjacent network segment per the CVSS vector (AV:A). No authentication or user interaction is required (PR:N, UI:N).

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-02-10, and EPSS gives a 30-day exploitation probability of 0.971 (99.9th percentile). Public exploit code exists (Exploit-DB 37171), and the vendor advisory is tagged as an exploit reference.

What to do

• Apply the vendor firmware update if a supported version exists; otherwise replace the device, as the product is end-of-life.
• Disconnect or retire any D-Link DIR-645 still in use, per CISA's required action for this KEV entry.
• If the device cannot be removed immediately, isolate it on a dedicated network segment and block HNAP access from untrusted networks.
• Disable remote administration and UPnP on the router where possible to reduce exposure.
• Monitor for and block outbound connections from the router to unknown external hosts.

Detection

• Inspect network traffic for HNAP requests containing GetDeviceSettings actions with shell metacharacters or unexpected command strings.
• Monitor router logs and network flows for anomalous outbound connections originating from the device.
• Use an asset inventory to identify any D-Link DIR-645 devices still active on the network and flag them for remediation.
• Watch for signs of router configuration changes, new admin accounts, or DNS settings modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.