The D-Link DIR-615 router contains a critical OS command injection vulnerability that allows remote attackers to execute arbitrary commands, posing a severe risk to network integrity.

This is an OS command injection flaw (CWE-78) located in the wiz_policy_3_machine.php file. An attacker with administrative privileges can trigger this vulnerability by manipulating the ipaddr argument to execute unauthorized system commands.

The ability to execute arbitrary OS commands on a network router provides an attacker with full control over the device, which can lead to complete compromise of network traffic, unauthorized access to internal resources, and potential pivot points into the broader corporate network. With a CVSS score of 7.2, this vulnerability represents a high-risk scenario, especially since the affected devices are end-of-life and no longer receiving vendor support.

Immediate Action: Since the product is end-of-life and no patch is available, the primary remediation is to decommission and replace the affected hardware immediately.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or shell commands originating from the management interface of the affected routers.

Compensating Controls: Restrict access to the device management interface to a dedicated management VLAN or trusted IP addresses only, and deploy a WAF or firewall rule to block requests containing suspicious shell metacharacters in the ipaddr parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical research write-up at the referenced Notion URL.

Given that the D-Link DIR-615 is no longer supported by the vendor, there is no expectation of a security patch. Organizations still utilizing this hardware must prioritize its replacement with current, supported equipment to eliminate the risk of remote command execution. If immediate replacement is not feasible, ensure the web management interface is completely isolated from the internet and internal user segments.