The vulnerability resides in the adv_firewall.php component of the DMZ Host Feature on D-Link DIR-615 routers running firmware 4.10. A malformed dmz_ipaddr parameter allows an attacker to inject arbitrary operating system commands that execute in the context of the web server. This flaw provides remote execution privilege; an attacker could take full control of the device, modify configuration, intercept traffic, or launch further attacks against the network.

The issue affects D-Link DIR-615 routers running firmware version 4.10. Devices are no longer supported by the vendor, so they remain vulnerable until a patch or newer firmware is applied.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score of less than 1 % signifies that exploitation is currently considered low probability, but the vulnerability is publicly disclosed and can be leveraged remotely without authentication. Even though the device is unsupported, the lack of an authorised firmware update increases the risk of exploitation. The vulnerability is not listed in the CISA KEV catalog, but its remote nature and command injection potential warrant urgent attention.