The flaw is an OS command injection vulnerability in the D‑Link DIR‑615 web management interface. By manipulating the ipaddr parameter in the file wiz_policy_3_machine.php, an attacker can inject shell commands that are executed on the underlying operating system. This grants the attacker remote code execution, compromising the device’s confidentiality, integrity, and availability.

The vulnerability affects D‑Link DIR‑615 routers running firmware up to version 4.10. The insecure functionality resides in the Web Management Interface component and applies to devices that are no longer supported by the vendor.

The CVSS score is 8.6, indicating high severity, while the EPSS score is less than 1%, implying a low chance of widespread exploitation today. The exploit is publicly documented and can be carried out remotely over the network, so exposed management interfaces are at significant risk. The vulnerability is not included in the CISA KEV catalog, but the public nature of the exploit and support status increase its potential impact.