CVE-2015-2051

HIGH KEV

D-Link DIR-645 Firmware < 1.05b01 - Remote Code Execution via HNAP GetDeviceSettings Action

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2015-2051 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 10, 2022. EIP tracks 2 public exploits from researchers including Metasploit, Samuel Huntley, Craig Heffner, including a Metasploit module exploits/linux/http/dlink_hnap_header_exec_noauth.

AI-analyzed exploit summary This Metasploit module exploits a blind OS command injection vulnerability in D-Link routers via the HNAP SOAP interface. It uses the SOAPAction header to inject commands, tested on DIR-645 and other models.

Description

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotehardware
https://www.exploit-db.com/exploits/37171

This Metasploit module exploits a blind OS command injection vulnerability in D-Link routers via the HNAP SOAP interface. It uses the SOAPAction header to inject commands, tested on DIR-645 and other models.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: D-Link routers (various models including DIR-645, DAP-1522, DIR-880L, etc.)
No auth needed
Prerequisites: Network access to the vulnerable device · HNAP SOAP interface enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Samuel Huntley, Craig Heffner · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_hnap_header_exec_noauth.rb

This Metasploit module exploits a blind OS command injection vulnerability in D-Link routers via the HNAP SOAP interface. It leverages the SOAPAction header to execute arbitrary commands without authentication.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: D-Link routers (e.g., DIR-645, DAP-1522 revB, DIR-880L, etc.)
No auth needed
Prerequisites: Network access to the vulnerable device · HNAP interface exposed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Exploit, Third Party Advisory, VDB Entry exploit
https://www.exploit-db.com/exploits/37171/
Broken Link, Third Party Advisory, VDB Entry vdb-entry
http://www.securityfocus.com/bid/72623
Broken Link, Third Party Advisory, VDB Entry vdb-entry
http://www.securityfocus.com/bid/74870

Scores

CVSS v3 8.8
EPSS 0.9710
EPSS Percentile 99.9%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-02-10
VulnCheck KEV 2019-05-23
InTheWild.io 2022-02-10
ENISA EUVD EUVD-2015-2164
CWE
CWE-77
Status published
Products (1)
dlink/dir-645_firmware < 1.05b01
Published Feb 23, 2015
KEV Added Feb 10, 2022
Tracked Since Feb 18, 2026