CVE-2026-1505 json
D-Link DIR-615 URL Filter set_temp_nodes.php os command injection
published 2026-01-28 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-4917
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.1%
- EPSS 5.1% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction
5.07% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- pentagonal-time-3a7.notion.site https://pentagonal-time-3a7.notion.site/D-Link-DIR-615-2e7e5dd4c5a580109a14fdeb6f105cd6 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R |
| CNA | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R |
| CNA | 2.0 | 8.3 | AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR |
| CNA | 4.0 | 7.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CNA | 2.0 | 8.3 | AV:N/AC:L/Au:M/C:C/I:C/A:C |
Affected products
- D-Link DIR-615
Classification
References
-
pentagonal-time-3a7.notion.site
/D-Link-DIR-615-2e7e5dd4c5a580109a14fdeb6f105cd6
exploit, third-party-advisory
-
vuldb.com
/?id.343117
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.343117
signature, permissions-required, vdb-entry
-
vuldb.com
/?submit.737061
third-party-advisory, vdb-entry
-
dlink.com
/
product
Sources
- CVE List CVE-2026-1505
- NVD CVE-2026-1505
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.