CVE-2018-25115

The vulnerability is located in the service.cgi endpoint, where the EVENT=CHECKFW parameter passed in an HTTP POST request is directly passed to the system shell without any input data sanitization (CWE-78: OS Command Injection). An attacker can craft an HTTP POST request containing malicious commands injected into the value of this parameter. The injected commands are executed immediately with root privileges, leading to complete device takeover.

The attacker gains full control over the device with root privileges — can execute arbitrary system commands, modify configuration, intercept network traffic, and use the device as an entry point to the local network. The result is complete device compromise.

D-Link manufacturer will not release patches for these devices as they are covered by End-of-Life policy. Immediate replacement of vulnerable devices with currently supported models is recommended. Until replacement, the following should be done: isolate devices from the internet (block access to the management interface from WAN), apply additional firewall rules restricting access to the service.cgi endpoint, and monitor network traffic for exploitation attempts.

D-Link DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 routers with firmware version 1.03. The exact range of affected versions may vary depending on the model — see references for details. All mentioned models are covered by the manufacturer's End-of-Life policy.