CVE-2015-1187

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
dlinkdir-626l_firmware
1.04:b04
dlinkdir-636l_firmware
1.04
dlinkdir-808l_firmware
1.03:b05
dlinkdir-810l_firmware
1.01:b04
dlinkdir-810l_firmware
2.02:b01
dlinkdir-820l_firmware
1.02:b10
dlinkdir-820l_firmware
1.05:b03
dlinkdir-820l_firmware
2.01:b02
dlinkdir-826l_firmware
1.00:b23
dlinkdir-830l_firmware
1.00:b07
dlinkdir-836l_firmware
1.01:b03
trendnettew-731br_firmware
2.01:b01
dlinkdir-651_firmware
1.10na:na
trendnettew-651br_firmware
-
trendnettew-652br_firmware
-
trendnettew-711br_firmware
1.00:b31
trendnettew-810dr_firmware
1.00:b19
trendnettew-813dru_firmware
1.00:b23
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.html
http://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.html
http://seclists.org/fulldisclosure/2015/Mar/15
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052
http://www.securityfocus.com/bid/72848
https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2
http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.html
http://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.html
http://seclists.org/fulldisclosure/2015/Mar/15
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052
http://www.securityfocus.com/bid/72848
https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2