# CVE-2015-2051

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

- Page: https://www.vulneraibility.com/cve/CVE-2015-2051
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2022-02-10; CISA due date 2022-08-10
- EPSS: 97.10% (percentile 99.9)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module (first 2015-06-01)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2024-05-02)
- Weakness: CWE-77
- Published: 2015-02-23

## Affected

- dlink:dir-645_firmware

## References

- [other] http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051
- [exploit] https://www.exploit-db.com/exploits/37171/
- [other] http://www.securityfocus.com/bid/72623
- [other] http://www.securityfocus.com/bid/74870
- [other] https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2051

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.