CVE-2026-1505
📋 TL;DR
This CVE describes a remote OS command injection vulnerability in D-Link DIR-615 routers via the /set_temp_nodes.php file in the URL Filter component. Attackers can execute arbitrary commands on affected devices, potentially gaining full control. Only unsupported D-Link DIR-615 routers running version 4.10 are affected.
💻 Affected Systems
- D-Link DIR-615
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, pivot to internal networks, intercept all network traffic, or brick the device.
Likely Case
Attackers gain shell access to modify router settings, create backdoors, or use the device for botnet activities.
If Mitigated
With proper network segmentation and access controls, impact limited to the router itself without lateral movement.
🎯 Exploit Status
Exploit details are publicly available. Remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
No official patch available as product is end-of-life. Replace affected hardware with supported models.
🔧 Temporary Workarounds
Disable URL Filter
allDisable the vulnerable URL Filter component if not required
Network Segmentation
allIsolate affected routers from critical network segments
🧯 If You Can't Patch
- Immediately replace affected DIR-615 routers with supported models
- Implement strict network access controls to limit router exposure
🔍 How to Verify
Check if Vulnerable:
Check router model and firmware version via web interface or SSH. If DIR-615 with firmware 4.10, assume vulnerable.Check Version:
Check web interface at http://router-ip/ or via SSH: cat /proc/versionVerify Fix Applied:
Verify router has been replaced with supported model or URL Filter is disabled.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /set_temp_nodes.php
- Suspicious command execution in system logs
- URL Filter configuration changes
Network Indicators:
- Unexpected outbound connections from router
- Traffic patterns suggesting command-and-control communication
SIEM Query:
source="router-logs" AND (uri="/set_temp_nodes.php" OR command="*;*" OR command="*|*")