CVE-2026-1448

7.3 highEPSS 5.8%

High (7.3) in dlink dir-615 firmware. EPSS 5.8% chance of exploitation in the next 30 days.

A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Management Interface. Performing a manipulation of the argument ipaddr results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Severity

CVSS 4.0

7.3 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.8% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-77
Published: 2026-01-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dlink:dir-615_firmware

References

https://pentagonal-time-3a7.notion.site/DIR-615-v4-10-2e7e5dd4c5a580a5aac5c8ce35933396?pvs=73
https://vuldb.com/?ctiid.342880
https://vuldb.com/?id.342880
https://vuldb.com/?submit.737006
https://www.dlink.com/

Check your stack JSON