CVE-2018-15839: D-Link DIR-615 router buffer overflow via long Authorization header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and public exploit code make this a high-risk unauthenticated remote flaw.

What it is

D-Link DIR-615 firmware contains a memory buffer overflow (CWE-119) triggered by an overly long Authorization HTTP header. The flaw is remotely reachable over the network with no privileges or user interaction required, and the CVSS 3.1 base score is 9.8 (critical). Successful exploitation can corrupt memory and potentially allow code execution or denial of service on the affected device.

Impact

An unauthenticated remote attacker can overflow a buffer in the router's HTTP handling, which may lead to arbitrary code execution or a crash/denial of service. Full compromise of confidentiality, integrity and availability is scored by the CVSS vector.

Attack surface

Reached over the network via HTTP by sending a crafted Authorization header to the DIR-615 web interface; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is needed. The description does not specify which firmware versions or interface paths are affected.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.45347, ~98.7th percentile) and public exploit code exists on Exploit-DB (45317), indicating practical exploitation is feasible. No ransomware association is documented.

What to do

• Apply the latest D-Link firmware for DIR-615 or replace the device if no fixed firmware is available; the record does not list a specific patched version.
• Disable remote/WAN administration and restrict the web interface to trusted management networks only.
• Place the device behind a firewall or reverse proxy that filters or normalizes oversized HTTP headers.
• Monitor vendor advisories for DIR-615 and retire end-of-support units that will not receive fixes.

Detection

• Inspect HTTP request logs or IDS/IPS signatures for abnormally long Authorization headers targeting the router web interface.
• Alert on crashes, reboots or unexpected process restarts of the DIR-615 management service.
• Watch for exploit traffic matching Exploit-DB 45317 patterns against D-Link management ports.
• Baseline normal Authorization header lengths and flag outliers from external or untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.