CVE-2026-2152

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web Configuration Interface. Performing a manipulation of the argument dest_ip/ submask/ gw results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
D-LinkDIR-6154.10

References

Timeline

Published
Feb 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-215207.5Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive informationCVE-2026-215217.4Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a netwCVE-2026-215226.7Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker tCVE-2026-215238.0Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a nCVE-2026-215247.4Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information ovCVE-2026-215256.2Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.CVE-2026-215276.5User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofiCVE-2026-215286.5Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-215295.4Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to peCVE-2026-21536.1A vulnerability was determined in mwielgoszewski doorman up to 0.6. This issue affects the function is_safe_url of the file doorman/users/viCVE-2026-215306.7Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.CVE-2026-215319.8Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
CVE-2026-2152: High severity, CVSS 7.2 | Vulnix