PT-2014-1984 · D Link+1 · D-Link+1
Stephan Rickauer
+1
·
Publicado
2014-11-30
·
Atualizado
2024-12-20
·
CVE-2015-1187
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
D-Link devices (affected versions not specified)
TRENDnet devices (affected versions not specified)
Description
The issue is related to a remote code execution problem in the ping tool of multiple D-Link and TRENDnet devices. It is caused by weaknesses in the authentication procedure when handling the ping command, specifically via the
ping addr parameter. This allows remote attackers to execute arbitrary code.Recommendations
For D-Link devices, consider restricting access to the ping tool until a fix is available.
For TRENDnet devices, avoid using the
ping addr parameter in the ping command until the issue is resolved.
As a temporary workaround, consider disabling the ping tool in both D-Link and TRENDnet devices to minimize the risk of exploitation.Exploit
Correção
Command Injection
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
D-Link
Trendnet