NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2015-1187

D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.

The impacted product is end-of-life and should be disconnected if still in use.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

Affected products

VendorProductAffected versions
DlinkDir-626l Firmware
Version 1.04
DlinkDir-636l Firmware
Version 1.04
DlinkDir-808l Firmware
Version 1.03
DlinkDir-810l Firmware
Versions 1.01, 2.02
DlinkDir-820l Firmware
Versions 1.02, 1.05, 2.01
DlinkDir-826l Firmware
Version 1.00
DlinkDir-830l Firmware
Version 1.00
DlinkDir-836l Firmware
Version 1.01
TrendnetTew-731br Firmware
Version 2.01
DlinkDir-651 Firmware
Version 1.10na
TrendnetTew-651br Firmware
All versions
TrendnetTew-652br Firmware
All versions

Weakness classification

CWE-287

References