A critical OS command injection vulnerability in the D-Link DIR-615 router allows remote attackers to execute arbitrary commands with high privileges.

This vulnerability involves OS command injection (CWE-78) within the adv_firewall.php component. An attacker with high privileges can manipulate the dmz_ipaddr parameter to inject and execute unauthorized operating system commands remotely.

The exploitation of this vulnerability allows for full system compromise, enabling an attacker to gain unauthorized control over the affected network device. Given the CVSS score of 7.2, this represents a high risk to network integrity and confidentiality. Because the affected product is identified as end of life and no longer supported, the risk of permanent exposure to this flaw is significant.

Immediate Action: As the product is no longer supported by the vendor, users should immediately decommission the affected D-Link DIR-615 hardware and replace it with a currently supported device.

Proactive Monitoring: Review system logs for suspicious activity involving the DMZ Host configuration or anomalous HTTP requests directed at the adv_firewall.php endpoint.

Compensating Controls: If immediate replacement is not feasible, isolate the device from the public internet using a restrictive firewall policy or a secondary gateway to limit the reach of potential remote attackers.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided by the researcher at the referenced Notion URL.

The presence of a public proof-of-concept combined with the end-of-life status of the D-Link DIR-615 makes this a high-priority risk. Organizations currently utilizing this device should prioritize its removal from the network environment to prevent potential unauthorized access and compromise of internal network segments.