A critical command injection vulnerability in the D-Link R15 (AX1500) router allows authenticated administrators to execute arbitrary system commands via the web interface.

The vulnerability exists within the web administrator page where the "model name" parameter is not correctly sanitized. An attacker with administrative access can manipulate this parameter during a password change request to trigger command injection within the httpd daemon.

A CVSS score of 9.8 reflects the severity of full system compromise. If exploited, an attacker could gain complete control over the network device, potentially facilitating lateral movement, man-in-the-middle attacks, or persistent access to the internal network.

Immediate Action: Apply the latest firmware update provided by D-Link for the R15 (AX1500) router.

Proactive Monitoring: Review administrative access logs for suspicious activity and monitor for unexpected changes to device configuration or system processes.

Compensating Controls: Restrict access to the router's web administration interface to trusted internal IP addresses only and disable remote management features.

Public Exploit Available: Not specified

The ability to execute arbitrary commands on network infrastructure is a high-risk scenario. Administrators must apply available patches immediately to mitigate the risk of device takeover. If a patch is not immediately available, ensure the device is isolated from the public internet.