peter bassill · operator
$ cve CVE-2015-1187 JSON

CVE-2015-1187 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 82.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-15.

Description

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS82.86% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-287
On CISA KEVyes — remediate by 2022-04-15
Public exploityes
Published2017-09-21
Last modified2026-06-17

CISA KEV

NameD-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
Added2022-03-25
Due2022-04-15
Vendor / productD-Link and TRENDnet / Multiple Devices
Ransomware usenone reported

Affected (30)

VendorProduct
dlinkdir-626l
dlinkdir-626l firmware
dlinkdir-636l
dlinkdir-636l firmware
dlinkdir-651
dlinkdir-651 firmware
dlinkdir-808l
dlinkdir-808l firmware
dlinkdir-810l
dlinkdir-810l firmware
dlinkdir-820l
dlinkdir-820l firmware
dlinkdir-826l
dlinkdir-826l firmware
dlinkdir-830l
dlinkdir-830l firmware
dlinkdir-836l
dlinkdir-836l firmware
trendnettew-651br
trendnettew-651br firmware
trendnettew-652br
trendnettew-652br firmware
trendnettew-711br
trendnettew-711br firmware
trendnettew-731br
trendnettew-731br firmware
trendnettew-810dr
trendnettew-810dr firmware
trendnettew-813dru
trendnettew-813dru firmware

Public exploits

SourceTitleDate
exploit-dbD-Link/TRENDnet - NCC Service Command Injection (Metasploit)2015-02-26

References

→ the Explorer  ·  watch your stack  ·  NVD