D-Link DIR-645 HNAP SOAPAction Command Injection

Successful exploitation allows a remote attacker to execute arbitrary operating system commands on the vulnerable router. This can result in full compromise of the device, including unauthorized control of router functions, malware installation, botnet enrollment, persistence, traffic interception or manipulation, and use of the device as a pivot for further network activity or DDoS operations.

Disable or restrict access to the HNAP interface wherever possible, especially from the WAN/Internet. Limit administrative access to trusted internal hosts or a dedicated management network, enforce firewall rules to block external access to router management services, and monitor for exploitation attempts referencing HNAP or GetDeviceSettings. Where immediate patching is not possible, isolate the device, disable remote administration, and apply IPS protections such as signatures for D-Link HNAP SOAPAction command execution attempts.

Upgrade the D-Link DIR-645 Rev. Ax to a fixed firmware release later than 1.04b12, if an official vendor patch is available. If the product is end-of-life or no patched firmware is available, replace the device with supported hardware. Restrict exposure of the router management and HNAP interfaces from untrusted networks and verify that internet-facing administrative access is disabled.