D-Link DIR-645 Router Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-10
• EPSS: 97% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

CISA: D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 10 Aug 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• securityadvisories.dlink.com/security/publication.aspxExploitVendor Advisory
• www.securityfocus.com/bid/72623Broken LinkThird Party AdvisoryVDB Entry
• www.securityfocus.com/bid/74870Broken LinkThird Party AdvisoryVDB Entry
• supportannouncement.us.dlink.com/announcement/publication.aspxVendor Advisory
• www.exploit-db.com/exploits/37171ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource