CVE-2018-5371

diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers…

published January 12, 2018

CVSS

—

EPSS

42%

Percentile

98.7

In the wild

Unconfirmed

What it is

diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.41987 · 98.7th percentile
Published: 2018-01-12T09:00Z

EPSS history

Timeline

12 JAN 09:00Z
diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers…
cvelistv5