The vulnerability is an OS command injection flaw (CWE-78, CWE-77) in the mac argument of the adv_mac_filter.php component of D‑Link DIR‑615 firmware 4.10. An attacker may supply crafted input to the mac parameter, which is passed directly to the operating system shell, allowing execution of arbitrary commands on the router. The flaw provides a full compromise of the device’s confidentiality, integrity and availability through remote exploitation.

This issue affects D‑Link DIR‑615 routers running firmware version 4.10. No supported firmware updates are available for this version and the product is no longer maintained by the vendor. The vulnerability is specific to the MAC Filter Configuration feature and does not extend to other components of the device.

The CVSS score of 8.6 classifies the flaw as high severity. Although the EPSS score is reported as less than 1%, indicating a low probability of exploitation, the vulnerability has been publicly disclosed and can be triggered remotely without authentication. The flaw is not listed in the CISA KEV catalog, but its impact and remote nature elevate its risk for exposed devices. Attackers would need network access to the router’s management interface to exploit the injection point.