The vulnerability resides in the adv_firewall.php component of the DMZ Host Feature on D-Link DIR-615 routers running firmware 4.10. A malformed dmz_ipaddr parameter allows an attacker to inject arbitrary operating system commands (CWE‑77, OS command injection) that execute in the context of the web server. This flaw provides remote execution privilege; an attacker could take full control of the device and modify its configuration. The potential to intercept traffic or launch further attacks is inferred from the severity and the nature of the flaw, but such specific impacts are not explicitly stated in the CVE description.

The issue affects D-Link DIR-615 routers running firmware version 4.10. Devices are no longer supported by the vendor, so they remain vulnerable until a patch or newer firmware is applied.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score of 4% signifies that exploitation is currently considered low probability, but the vulnerability is publicly disclosed and can be leveraged remotely without authentication. Even though the device is unsupported, the lack of an authorized firmware update increases the risk of exploitation. The vulnerability is not listed in the CISA KEV catalog, but its remote nature and command injection potential warrant urgent attention.