CVE-2018-16752

LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.
References
Link Resource
http://packetstormsecurity.com/files/149297/LW-N605R-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45351/ Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:linknet-usa:lw-n605r_firmware:12.20.2.1486:*:*:*:*:*:*:*
cpe:2.3:h:linknet-usa:lw-n605r:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-09-20 20:29

Updated : 2024-02-28 16:48


NVD link : CVE-2018-16752

Mitre link : CVE-2018-16752

CVE.ORG link : CVE-2018-16752


JSON object : View

Products Affected

linknet-usa

  • lw-n605r
  • lw-n605r_firmware
CWE
CWE-1188

Insecure Default Initialization of Resource

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')