RCE in D-link Dir-615
CVE-2026-1448
A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Management Interface. Performing a manipulation of the argument ipaddr results in os com…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.006 (68.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R.
Affected products
- D-link Dir-615 — versions 4.0, 4.1, 4.2
Weakness classification (CWE)
References
- VDB-342880 | D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection (vdb-entry, technical-description)
- VDB-342880 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
- Submit #737006 | Dlink DIR615 Firmware v4.10 and earlier (DIR-615 Rev D) OS Command Injection (third-party-advisory)
- pentagonal-time-3a7.notion.site/DIR-615-v4-10-2e7e5dd4c5a580a5aac5c8ce35933396 (exploit)
- www.dlink.com/ (product)
Frequently asked questions
- What is CVE-2026-1448?
- CVE-2026-1448 is a high-severity vulnerability in D-link Dir-615, classified under OS Command Injection. CVSS score: 7.2/10. Published 2026-01-26.
- How severe is CVE-2026-1448?
- High severity. CVSS v3 base score is 7.2 out of 10.