high8.8
CVE-2018-5371
diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers…
Impact
diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| D-Link | Dsl-2540u Firmware | Version me_1.00 |
| D-Link | Dsl-2640u Firmware | Versions im_1.00, me_1.00 |