HighCISA KEVExploited in the wildPublic exploit

D-Link DIR-645 HNAP SOAPAction Command Injection

IdentifiersCVE-2015-2051CWE-78

CVE-2015-2051 is a remote command injection vulnerability in the HNAP interface of the D-Link DIR-645 Wired/Wireless Router Rev. Ax. According to the provided content, firmware version 1.04b12 and earlier are affected. The flaw is exposed through the HNAP GetDeviceSettings action, where a remote attacker can supply crafted input via the SOAPAction handling in the HNAP service and cause arbitrary commands to be executed on the device.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote attacker to execute arbitrary commands on the vulnerable router. This can result in full compromise of the device, including unauthorized control of router functions, modification of configuration, malware installation, botnet enrollment, persistence, traffic interception or redirection, and use of the device as a pivot for further network activity.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the router management and HNAP interfaces to trusted administrative networks only. Disable remote administration if not required. Block WAN-side access to the device’s management plane with firewall rules or upstream ACLs. Monitor for suspicious requests targeting HNAP/SOAPAction headers and for signs of post-compromise activity. Where available, deploy IPS protections such as signatures for D-Link HNAP SOAPAction command execution attempts.

Remediation

Patch, then assume compromise.

Upgrade affected D-Link DIR-645 Rev. Ax devices to a fixed firmware version later than 1.04b12, if available from the vendor. If the product is end-of-life or no patched firmware is available, replace the device with supported hardware. Review vendor guidance for HNAP-related fixes and ensure internet-exposed management interfaces are not left accessible.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

D-LinkDir-645hardware

D-LinkDir-645 Firmwareoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

security affairsNews

Jun 8, 2026

IoT Botnet C0XMO Adds Competitor-Killing Capability

A vulnerability in D-Link devices that is explicitly targeted by the C0XMO scanner as part of its HTTP exploitation module.

cyber security newsNews

Jun 5, 2026

New Gafgyt Variant Targets Multiple Linux Architectures With Modular Propagation

A command execution vulnerability in D-Link devices via the HNAP SOAPAction header, included in the C0XMO exploit toolkit.

fortinet threat research blogNews

Jun 3, 2026

Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO | FortiGuard Labs

A D-Link devices HNAP SOAPAction header command execution vulnerability included among the HTTP-based exploits used by the scanner for initial access.

fortinet threat researchNews

Jun 3, 2026

Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO | FortiGuard Labs

A D-Link HNAP SOAPAction header command execution vulnerability included among the scanner's HTTP-based exploitation capabilities for initial access.

+7 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware9

Malware families riding this exploit, with evidence and IOCs.

Detection signatures2

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2015-2051

NVD

nvd.nist.gov/vuln/detail/CVE-2015-2051

MITRE CWE · CWE-78

cwe.mitre.org

Vendor Advisory

securityadvisories.dlink.com/security/publication.aspx?name=SAP10051

Vendor Advisory

supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282

Third Party Advisory

exploit-db.com/exploits/37171

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2051