CVE-2026-2152
Published: 08 February 2026
Summary
CVE-2026-2152 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Dir-615 Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of untrusted inputs such as dest_ip, submask, and gw parameters in the web configuration interface to directly prevent OS command injection.
Prohibits use of unsupported system components like the end-of-life D-Link DIR-615 router, eliminating exposure to unpatched vulnerabilities like this command injection.
Mandates identification and remediation of flaws such as this OS command injection vulnerability, through patching, isolation, or decommissioning given no vendor support.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in the router web UI directly enables T1190 (exploit of public-facing app) and T1059.004 (Unix shell command execution on the embedded device).
NVD Description
A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web Configuration Interface. Performing a manipulation of the argument dest_ip/ submask/ gw results in os command injection. The attack may…
more
be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2026-2152 is an OS command injection vulnerability (CWE-77, CWE-78) discovered in D-Link DIR-615 routers running firmware version 4.10. The issue affects unknown code within the adv_routing.php file of the Web Configuration Interface, where manipulation of the dest_ip, submask, and gw arguments enables arbitrary OS command execution. Published on 2026-02-08, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
A remote attacker with high privileges (PR:H) can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing full compromise of the affected device through injected commands.
This vulnerability impacts products no longer supported by the maintainer, with no patches available. An exploit has been publicly disclosed and could be used, as detailed in advisories from VulDB and a Notion site proof-of-concept. Practitioners should decommission or isolate DIR-615 devices, per references including https://vuldb.com/?id.344854 and https://pentagonal-time-3a7.notion.site/DIR-615-routing-command-injection-2f6e5dd4c5a580089587f5e78a1bbf70.
Details
- CWE(s)