Which versions of Dir 645 are affected by CVE-2026-5815?

D-Link DIR-645 routers (versions 1.01-1.03) contain a stack-based buffer overflow in the web interface that allows authenticated attackers to gain complete control of the device.

Is there a public PoC exploit available for CVE-2026-5815?

Yes, a public proof-of-concept exploit is available for CVE-2026-5815. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-5815?

Within 24 hours: Identify all D-Link DIR-645 devices on the network using inventory tools and determine business-critical vs. non-critical deployments. Within 7 days: Implement network segmentation-isolate affected routers to a restricted management VLAN with access controls limiting administrative traffic only. Within 30 days: Complete replacement of all DIR-645 units with current, vendor-supported router models and validate connectivity before decommissioning legacy devices.

Dir 645 CVE-2026-5815

Q: What is the CVSS score of CVE-2026-5815?

CVE-2026-5815 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-20809 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-08 VulDB

Buffer Overflow D-Link Stack Overflow Dir 645 D-Link

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 00:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 08, 2026 - 23:31 euvd

EUVD-2026-20809

Analysis Generated

Apr 08, 2026 - 23:31 vuln.today

CVE Published

Apr 08, 2026 - 23:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in D-Link DIR-645 1.01/1.02/1.03. Impacted is the function hedwigcgi_main of the file /cgi-bin/hedwig.cgi. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in D-Link DIR-645 router (versions 1.01, 1.02, 1.03) via hedwigcgi_main function in /cgi-bin/hedwig.cgi allows authenticated remote attackers to achieve complete system compromise. Exploitation requires low-privilege credentials but no user interaction. Publicly available exploit code exists. Product is end-of-life with no vendor support, making remediation limited to device replacement or network isolation.

Technical ContextAI

CWE-121 stack-based buffer overflow triggered through unsanitized input to hedwigcgi_main handler in hedwig.cgi CGI script. CVSS 4.0 vector PR:L indicates authenticated attack vector. Affects CPE cpe:2.3:a:d-link:dir-645 across firmware versions 1.01-1.03. Overflow enables arbitrary code execution in router context.

RemediationAI

No vendor-released patch identified at time of analysis; D-Link has discontinued support for DIR-645 hardware per vendor statement. Primary recommendation: replace device with currently supported router model from active product line. Interim mitigation: disable remote administration interfaces, restrict /cgi-bin/hedwig.cgi access via firewall ACLs permitting only trusted management IPs, implement network segmentation isolating device from critical assets, enforce strong authentication credentials, monitor for unauthorized access attempts. Consult D-Link EOL policy and migration guidance at https://www.dlink.com/. Detailed technical writeup and proof-of-concept analysis available at https://github.com/Pers1st0/CVE/blob/main/stack-based%20buffer%20overflow%20vulnerability%20exists%20in%20the%20hedwig.cgi%20of%20D-Link%20DIR-645.md and https://vuldb.com/vuln/356263.