cve/cves/2015/CVE-2015-2051.md

CVE-2015-2051

Description

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

POC

Reference

• https://www.exploit-db.com/exploits/37171/

Github

• https://github.com/Walnut1337/Command-Injection-DIR-868L

ExploitDB

• https://www.exploit-db.com/exploits/37171

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_hnap_header_exec_noauth.rb