A critical command injection vulnerability in D-Link R15 routers permits unauthenticated remote attackers to execute arbitrary code on the device.

The vulnerability exists in the httpd service, where the model name parameter is not properly sanitized during a password change request. This allows an unauthenticated remote attacker to inject and execute system-level commands.

Successful exploitation grants an attacker full control over the affected router, potentially leading to unauthorized network access, interception of traffic, or the device becoming part of a botnet. The CVSS score of 9.8 reflects the high severity of remote code execution on network infrastructure.

Immediate Action: Consult the official D-Link support announcement (SAP10473) and apply the latest firmware update provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router and check administrative logs for suspicious password change attempts.

Compensating Controls: Isolate the management interface of the router from the public internet and restrict access to the web administration page to trusted internal IP addresses only.

Public Exploit Available: Yes — a public PoC repository exists on GitHub.

Owners of the D-Link R15 (AX1500) must verify their current firmware version immediately. If the device is running version 1.20.01 or below, it is imperative to update to the latest available firmware provided by D-Link to mitigate the risk of remote command injection.