PT-2014-1984 · D Link+1 · D-Link+1
Stephan Rickauer
+1
·
Published
2014-11-30
·
Updated
2024-12-20
·
CVE-2015-1187
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
D-Link devices (affected versions not specified)
TRENDnet devices (affected versions not specified)
Description
The issue is related to a remote code execution problem in the ping tool of multiple D-Link and TRENDnet devices. It is caused by weaknesses in the authentication procedure when handling the ping command, specifically via the
ping addr parameter. This allows remote attackers to execute arbitrary code.Recommendations
For D-Link devices, consider restricting access to the ping tool until a fix is available.
For TRENDnet devices, avoid using the
ping addr parameter in the ping command until the issue is resolved.
As a temporary workaround, consider disabling the ping tool in both D-Link and TRENDnet devices to minimize the risk of exploitation.Exploit
Fix
Command Injection
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
D-Link
Trendnet