Loading vulnerability…
HNAP SOAPAction Header Command Injection in D-Link DIR-645
CVE-2015-2051 is an OS command injection vulnerability affecting D-Link DIR-645 Wired/Wireless Router Rev. Ax devices running firmware 1.04b12 or earlier. Crafted HTTP requests containing malicious commands in the SOAPAction header exploit the GetDeviceSettings action of the Home Network Administration Protocol (HNAP) interface, enabling remote arbitrary command execution. Exploitation can occur through blind OS command injection and has been used by multiple IoT botnets to compromise routers and deploy malware.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can give attackers full control of an affected router, compromise device integrity, and expose information. Observed campaigns use the resulting command execution to download and execute botnet payloads, collect system information, establish persistence, and enroll compromised devices in distributed denial-of-service infrastructure. These post-exploitation capabilities depend on the deployed malware.
If you can’t patch tonight, do this now.
Restrict network access to the HNAP management interface and disable unnecessary exposed management services where supported. Deploy IPS protection for HNAP SOAPAction-header command execution, segment vulnerable IoT devices from critical systems, and monitor for exploitation and unauthorized malware deployment. These controls do not replace a firmware fix.
Patch, then assume compromise.
Apply available D-Link security patches and upgrade affected routers to firmware that addresses CVE-2015-2051. A specific fixed firmware version is not established here. Discontinue use of end-of-life router products that cannot receive security fixes.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.