CVE-2026-2151

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability has been found in D-Link DIR-615 4.10. This affects an unknown part of the file adv_firewall.php of the component DMZ Host Feature. Such manipulation of the argument dmz_ipaddr  leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
D-LinkDIR-6154.10

References

Timeline

Published
Feb 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-215108.8Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-215117.5Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.CVE-2026-215126.5Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.CVE-2026-215138.8Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-215147.8Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature loCVE-2026-215159.9Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a nCVE-2026-215167.8Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to exeCVE-2026-215177.0Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges loCVE-2026-215188.8Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unautCVE-2026-215197.8Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges CVE-2026-21527.2A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web CCVE-2026-215207.5Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information
CVE-2026-2151: High severity, CVSS 7.2 | Vulnix