D-Link Dir-615 Firmware vulnerabilities

19 CVEs affecting D-Link Dir-615 Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2152, published 2026-02-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-16920: D-Link Multiple Routers Command Injection Vulnerability, published 2019-09-27. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device…
CVE-2014-8361: Realtek SDK Improper Input Validation Vulnerability, published 2015-05-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-09-18. EPSS: 100% chance of exploitation in the next 30 days. The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
CVE-2021-42627, published 2022-08-23. Critical severity, CVSS 9.8. EPSS: 63.1% chance of exploitation in the next 30 days. The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and…
CVE-2018-15839, published 2018-08-28. Critical severity, CVSS 9.8. EPSS: 45.3% chance of exploitation in the next 30 days. D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.
CVE-2019-19742, published 2019-12-18. Medium severity, CVSS 4.8. EPSS: 19.8% chance of exploitation in the next 30 days. On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
CVE-2024-0717, published 2024-01-19. Medium severity, CVSS 5.3. EPSS: 18.2% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820,…
CVE-2013-10050, published 2025-08-01. High severity, CVSS 8.8. EPSS: 13.6% chance of exploitation in the next 30 days. An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface…
CVE-2018-25115, published 2025-08-27. Critical severity, CVSS 9.8. EPSS: 10.1% chance of exploitation in the next 30 days. Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows…
CVE-2019-17525, published 2020-04-21. High severity, CVSS 8.8. EPSS: 5.8% chance of exploitation in the next 30 days. The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.
CVE-2026-1448, published 2026-01-27. High severity, CVSS 7.2. EPSS: 5.8% chance of exploitation in the next 30 days. A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Management Interface. Performing a manipulation…

Latest

CVE-2026-2152, published 2026-02-08. High severity, CVSS 7.2. EPSS: 5.4% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web Configuration Interface. Performing a manipulation of the…
CVE-2026-2151, published 2026-02-08. High severity, CVSS 7.2. EPSS: 5.3% chance of exploitation in the next 30 days. A vulnerability has been found in D-Link DIR-615 4.10. This affects an unknown part of the file adv_firewall.php of the component DMZ Host Feature. Such manipulation of the argument dmz_ipaddr leads…
CVE-2026-1506, published 2026-01-28. High severity, CVSS 7.2. EPSS: 5.6% chance of exploitation in the next 30 days. A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php of the component MAC Filter Configuration. This manipulation of the argument mac…
CVE-2026-1505, published 2026-01-28. High severity, CVSS 7.2. EPSS: 5.1% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The manipulation results in os command…
CVE-2021-40654, published 2021-09-24. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page