Actively exploited · Published Sep 21, 2017 · Assigned by mitre
CVE-2015-1187
Critical 9.8 Exploited
In plain English
A critical-severity improper authentication in Multiple Devices from D-Link and TRENDnet. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 82.7% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Apr 15, 2022.
Official description
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052 x_refsource_CONFIRM
- http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.html x_refsource_MISC
- http://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.html x_refsource_MISC
- https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2 x_refsource_MISC
- 72848 vdb-entry, x_refsource_BID
- 20150302 CVE-2015-1187: D-Link DIR-636L Remote Command Injection - Incorrect Authentication mailing-list, x_refsource_FULLDISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1187 government-resource