Riskcovery

CVE-2026-1448

D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection

State
Published
Severity
8.6 High
Published
Jan 26, 2026
Updated
Feb 23, 2026
Reserved
Jan 26, 2026

Read the record on cve.org

Description

A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Management Interface. Performing a manipulation of the argument ipaddr results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSSScoreVectorSource
4.08.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:PVulDB
3.17.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:RVulDB
3.07.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:RVulDB
2.08.3 HighAV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:URVulDB

Weaknesses

Affected Products

ProductVersions
DIR-615D-Link
  • 4.0Affected
  • 4.1Affected
  • 4.2Affected
  • 4.3Affected
  • 4.4Affected
  • 4.5Affected
  • 4.6Affected
  • 4.7Affected
  • 4.8Affected
  • 4.9Affected
  • 4.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.