CVE-2015-2051

CVE-2015-2051 describes a remote command execution in D-Link DIR-645 (Wired/Wireless Router) Rev. Ax with firmware 1.04b12 and earlier via the HNAP GetDeviceSettings action. The flaw allows an unauthenticated attacker to trigger arbitrary commands through the HNAP SOAP interface, leading to full ...

CVE-2013-7471

A Command Injection vulnerability exists in the soap.cgi?service=WANIPConn1 URL on several D-Link devices, including DIR-845 (before v1.02b03), DIR-600 (before v2.17b01), DIR-645 (before v1.04b11), DIR-300 (rev. B), and DIR-865 . The root cause is the improper filtering of shell metacharacters wi...

CVE-2021-43722

CVE-2021-43722 affects D-Link DIR-645 (firmware v1.03 A1). The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the stack without size limit, causing a stack-based buffer overflow. CVSS data from NVD/OpenVAS indicate a high/critical impact when exploited ...

CVE-2022-32092

CVE-2022-32092 affects the D-Link DIR-645 router (v1.03) with a command injection vulnerability exposed through the QUERY_STRING parameter in the __ajax_explorer.sgi endpoint. Red Hat/OpenVAS/CVE aggregations and the NVD entry all describe this as a remote, unauthenticated, network-executable iss...

CVE-2023-36089

CVE-2023-36089 concerns a remote authentication bypass in D-Link DIR-645, firmware 1.03, via the phpcgi_main function in cgibin. The Red Hat/NVD entries describe an attacker gaining escalated privileges without user interaction. The issue is tied to products that are no longer supported, and no o...

CVE-2022-46475

CVE-2022-46475 affects D-Link DIR-645A1 (DIR-645) firmware 1.06B01_Beta01, with a stack overflow in the genacgi_main function triggered via the service= parameter. The vulnerability arises from memory corruption in the affected CGI handling, enabling a remote attacker to potentially crash or take...

CVE-2013-7389

The D-Link DIR-645 Router (Rev. A1) is vulnerable to multiple cross-site scripting (XSS) issues in firmware versions prior to 1.04B11 . Remote attackers can inject arbitrary web scripts or HTML by exploiting the deviceid parameter in parentalcontrols/bind.php, the RESULT parameter in info.php, or...

CVE-2020-25786

CVE-2020-25786 affects D-Link DIR-816L (2.06.B09_BETA) and DIR-803 (1.04.B02). A flaw in webinc/js/info.php allows XSS via the HTTP Referer header . Public notes: affected products are no longer supported by the maintainer; exploitability is typically limited due to URL encoding (except in Intern...

CVE-2015-2052

The D-Link DIR-645 Wired/Wireless Router Rev. Ax is susceptible to a stack-based buffer overflow in its microprogrammed software. This vulnerability exists in the HNAP interface and can be triggered by a remote attacker sending a very long string during a GetDeviceSettings action. If successfully...

CVE-2018-25115

Multiple D-Link DIR-series routers, including DIR-110 , DIR-412 , DIR-600 , DIR-610 , DIR-615 , DIR-645 , and DIR-815 running firmware version 1.03 , are vulnerable to remote code execution (RCE) . The flaw exists in the service.cgi endpoint due to improper input handling of the EVENT=CHECKFW par...

CVE-2025-7192

CVE-2025-7192 affects D-Link DIR-645 devices (firmware up to 1.05B01). The vulnerability resides in the ssdpcgi component, specifically the ssdpcgi_main function under /htdocs/cgibin, where insufficient input filtering allows remote command injection. Reported consequences include full integrity,...

CVE-2025-10689

The CVE-2025-10689 entry concerns D-Link DIR-645 firmware (model 105B01). A vulnerability exists in the soapcgi_main function within /soap.cgi where manipulation of the service argument enables remote command injection. The issue can be exploited remotely and publicly available exploit code is no...