D-Link DIR 645 Vulnerabilities & CVEs

Q: Is my D-Link DIR 645 affected by these vulnerabilities?

Only if you’re running a firmware version in the affected range listed above and haven’t updated. Check your router's admin panel for its current firmware version and compare it against the ranges below.

Q: How do I update my D-Link DIR 645's firmware?

Log into the router's web admin panel (usually at its local IP address) and look for a Firmware Update or System Update section, or use the vendor's mobile app if it has one.

Q: Does ProbeShield fix these vulnerabilities for me?

No — ProbeShield scans your network and tells you what it finds (open ports, default credentials, outdated firmware signals) so you know what to fix, and how. It never changes your devices’ settings.

Known CVEs

CVE-2013-7471CRITICAL (9.8)

An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell met...

Affected: versions < 1.04b11Fixed in: 1.04b11

CVE-2021-43722CRITICAL (9.8)

D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the stack and has no limit on the size.

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

CVE-2022-32092CRITICAL (9.8)

D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter at __ajax_explorer.sgi.

Affected: versions <= 1.03Fixed in: later than 1.03

CVE-2022-46475CRITICAL (9.8)

D-Link DIR 645A1 1.06B01_Beta01 was discovered to contain a stack overflow via the service= variable in the genacgi_main function.

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

CVE-2023-36089CRITICAL (9.8)

Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that ...

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

CVE-2018-25115CRITICAL (9.8)

Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers t...

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

CVE-2015-2051HIGH (8.8)CISA KEV

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

Affected: versions < 1.05b01Fixed in: 1.05b01

CVE-2025-7192MEDIUM (6.3)

A vulnerability was found in D-Link DIR-645 up to 1.05B01 and classified as critical. This issue affects the function ssdpcgi_main of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command...

Affected: versions <= 1.05b01Fixed in: later than 1.05b01

CVE-2025-10689MEDIUM (6.3)

A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgi_main of the file /soap.cgi. Such manipulation of the argument service leads to command injection. The attack can be laun...

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

CVE-2020-25786MEDIUM (6.1)

webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. N...

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

Commonly exposed ports

Port 23 (Telnet) — Sends admin credentials unencrypted — a common target on older router firmware.
Port 80 (HTTP admin panel) — The web admin UI; dangerous if remote/WAN administration is left enabled.
Port 7547 (TR-069 (CWMP)) — ISP remote-management protocol — has been the entry point for several router botnets.
Port 1900 (UPnP/SSDP) — Lets apps on your LAN open firewall holes automatically, sometimes without your knowledge.

Default credentials

From ProbeShield's own tested default-credential list (see probeshield.com/default-passwords/): "admin" / "d-link" or "admin" / "pass" over HTTP.

Hardening checklist

Disable remote (WAN-side) administration unless you specifically need it.
Turn off UPnP unless a specific app you trust requires it.
Turn off WPS — it can let an attacker bypass your Wi-Fi password.
Change the default admin username and password to something unique.
Check for a firmware update in the router’s admin panel and apply it.
Disable Telnet/SSH management access if you don’t actively use it.

Frequently asked questions

Is my D-Link DIR 645 affected by these vulnerabilities? Only if you’re running a firmware version in the affected range listed above and haven’t updated. Check your router's admin panel for its current firmware version and compare it against the ranges below.

How do I update my D-Link DIR 645's firmware? Log into the router's web admin panel (usually at its local IP address) and look for a Firmware Update or System Update section, or use the vendor's mobile app if it has one.

Does ProbeShield fix these vulnerabilities for me? No — ProbeShield scans your network and tells you what it finds (open ports, default credentials, outdated firmware signals) so you know what to fix, and how. It never changes your devices’ settings.

Sources: National Vulnerability Database (NVD), CISA Known Exploited Vulnerabilities Catalog. This page lists which firmware versions are affected — it doesn't claim your specific unit is vulnerable. Check your device's current firmware version in its admin panel and compare it against the ranges above.