CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2015-1187
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
Severity
- EPSS
- 83% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2022-03-25, due 2022-04-15
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dlink:dir-626l_firmware
- dlink:dir-636l_firmware
- dlink:dir-651_firmware
- dlink:dir-808l_firmware
- dlink:dir-810l_firmware
- dlink:dir-820l_firmware
- dlink:dir-826l_firmware
- dlink:dir-830l_firmware
- dlink:dir-836l_firmware
- trendnet:tew-651br_firmware
- trendnet:tew-652br_firmware
- trendnet:tew-711br_firmware
- trendnet:tew-731br_firmware
- trendnet:tew-810dr_firmware
- trendnet:tew-813dru_firmware
References
- http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.html
- http://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.html
- http://seclists.org/fulldisclosure/2015/Mar/15
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052
- http://www.securityfocus.com/bid/72848