CVE-2015-1187criticalunder attackCWE-287

CVE-2015-1187

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 83%
from disclosure to weaponsame day
Published on NVDSep 21
1st PoCFeb 26
metasploitFeb 26
CISA KEV+1646d
Action required by CISAfederal deadline: 2022-04-15

The impacted product is end-of-life and should be disconnected if still in use.

In short

A vulnerability in the ping tool of D-Link and TRENDnet devices allows attackers to run malicious code remotely by sending a specially crafted request. This is critical because it gives attackers complete control over the device without any authentication required.

Technical detail

The ping_addr parameter in ping.ccp is vulnerable to command injection, allowing unauthenticated remote code execution. The attack vector is network-based HTTP/HTTPS requests to the device's web interface, requiring no authentication due to CWE-287 (Improper Authentication). Successful exploitation results in arbitrary code execution with device-level privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.