CVE-2018-16752

EUVD-2018-8552
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
Affected Products (NVD)
VendorProductVersion
linknet-usalw-n605r_firmware
12.20.2.1486
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/149297/LW-N605R-Remote-Code-Execution.html
https://www.exploit-db.com/exploits/45351/
http://packetstormsecurity.com/files/149297/LW-N605R-Remote-Code-Execution.html
https://www.exploit-db.com/exploits/45351/