CVE-2015-2051

CVE-2015-2051 describes a remote command execution in D-Link DIR-645 (Wired/Wireless Router) Rev. Ax with firmware 1.04b12 and earlier via the HNAP GetDeviceSettings action. The flaw allows an unauthenticated attacker to trigger arbitrary commands through the HNAP SOAP interface, leading to full ...

CVE-2013-7471

CVE-2013-7471 affects D-Link DIR-845 (pre-1.02b03), DIR-600 (pre-2.17b01), DIR-645 (pre-1.04b11), DIR-300 rev. B, and DIR-865. Root cause: command injection via shell metacharacters in the SOAP POST request fields NewInternalClient, NewExternalPort, or NewInternalPort of soap.cgi?service=WANIPCon...

CVE-2021-43722

CVE-2021-43722 affects D-Link DIR-645 (firmware v1.03 A1). The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the stack without size limit, causing a stack-based buffer overflow. CVSS data from NVD/OpenVAS indicate a high/critical impact when exploited ...

CVE-2022-32092

CVE-2022-32092 affects the D-Link DIR-645 router (v1.03) with a command injection vulnerability exposed through the QUERY_STRING parameter in the __ajax_explorer.sgi endpoint. Red Hat/OpenVAS/CVE aggregations and the NVD entry all describe this as a remote, unauthenticated, network-executable iss...

CVE-2023-36089

CVE-2023-36089 concerns a remote authentication bypass in D-Link DIR-645, firmware 1.03, via the phpcgi_main function in cgibin. The Red Hat/NVD entries describe an attacker gaining escalated privileges without user interaction. The issue is tied to products that are no longer supported, and no o...

CVE-2013-7389

CVE-2013-7389 affects the D-Link DIR-645 Router (Rev. A1) with firmware prior to 1.04B11. The issue is multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the deviceid parameter to parentalcontrols/bind.php, the RESULT paramet...

CVE-2022-46475

CVE-2022-46475 affects D-Link DIR-645A1 (DIR-645) firmware 1.06B01_Beta01, with a stack overflow in the genacgi_main function triggered via the service= parameter. The vulnerability arises from memory corruption in the affected CGI handling, enabling a remote attacker to potentially crash or take...

CVE-2015-2052

Affected : D-Link DIR-645 Wired/Wireless Router Rev. Ax, firmware 1.04b12 and earlier. Vulnerability : stack-based buffer overflow in the HNAP GetDeviceSettings action allows remote attackers to execute arbitrary code via a long string. Impact : remote code execution with full confidentiality, in...

CVE-2020-25786

CVE-2020-25786 affects D-Link DIR-816L (2.06.B09_BETA) and DIR-803 (1.04.B02). A flaw in webinc/js/info.php allows XSS via the HTTP Referer header . Public notes: affected products are no longer supported by the maintainer; exploitability is typically limited due to URL encoding (except in Intern...

CVE-2018-25115

Multiple D-Link DIR-series routers (DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, DIR-815) are affected by a remote code execution vulnerability in the /service.cgi endpoint. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system...

CVE-2025-7192

CVE-2025-7192 affects D-Link DIR-645 devices (firmware up to 1.05B01). The vulnerability resides in the ssdpcgi component, specifically the ssdpcgi_main function under /htdocs/cgibin, where insufficient input filtering allows remote command injection. Reported consequences include full integrity,...

CVE-2025-10689

The CVE-2025-10689 entry concerns D-Link DIR-645 firmware (model 105B01). A vulnerability exists in the soapcgi_main function within /soap.cgi where manipulation of the service argument enables remote command injection. The issue can be exploited remotely and publicly available exploit code is no...