The D-Link DIR-615 router contains a critical OS command injection vulnerability that allows remote attackers to execute arbitrary commands on the device.

This vulnerability is an OS command injection flaw (CWE-78) located in the adv_routing.php file of the web configuration interface. An authenticated attacker with high privileges can trigger command execution by manipulating the dest_ip, submask, or gw arguments.

Successful exploitation grants an attacker full control over the affected router, potentially allowing them to intercept network traffic, modify configuration settings, or use the device as a pivot point for lateral movement within the internal network. With a CVSS score of 7.2, this vulnerability represents a significant risk to network integrity and confidentiality. Because the device is no longer supported by the vendor, there is no expectation of an official security update to resolve this flaw.

Immediate Action: Since the product is end-of-life and no patch will be provided, immediately retire and replace the affected D-Link DIR-615 hardware with a currently supported device.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router management interface and review administrative logs for suspicious parameter strings associated with routing configuration changes.

Compensating Controls: If the device cannot be immediately replaced, restrict access to the web management interface to a dedicated management VLAN or trusted IP addresses via firewall rules to prevent unauthorized remote access.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up referenced by the CVE record.

Given that the D-Link DIR-615 is officially unsupported and this vulnerability allows for remote command execution, the risk of continued operation is extreme. Organizations must prioritize the decommissioning of these devices, as no vendor-supplied patch is forthcoming to remediate the underlying security flaw.