CVE-2015-1187
CVE-2015-1187
In short
A vulnerability in the ping tool of D-Link and TRENDnet devices allows attackers to run malicious code remotely by sending a specially crafted request. This is critical because it gives attackers complete control over the device without any authentication required.
Technical detail
The ping_addr parameter in ping.ccp is vulnerable to command injection, allowing unauthenticated remote code execution. The attack vector is network-based HTTP/HTTPS requests to the device's web interface, requiring no authentication due to CWE-287 (Improper Authentication). Successful exploitation results in arbitrary code execution with device-level privileges.
Summary generated and translated by AI from the official description.
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 3
cve_referencepacketstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.htmlunverifiedcve_referencepacketstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.htmlunverifiedexploitdbwww.exploit-db.com/exploits/41677unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.htmlhttp://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Mar/15http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1187http://www.securityfocus.com/bid/72848