CVE-2018-5371
Last modified
CVE-2018-5371 is a vulnerability of currently unknown severity. diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request.. EPSS estimates a 41.99% chance of exploitation in the next 30 days.
Description
diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| D-Link | Dsl-2540u Firmware | me_1.00 |
| D-Link | Dsl-2640u Firmware | im_1.00 |
| D-Link | Dsl-2640u Firmware | me_1.00 |
References
- https://www.iplantom.com/2018/01/10/dsl2640U/Exploit, Technical Description, Third Party Advisory, URL Repurposed
- https://www.iplantom.com/2018/01/10/dsl2640U/Exploit, Technical Description, Third Party Advisory, URL Repurposed
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-5371?
How severe is CVE-2018-5371?
How do I fix CVE-2018-5371?
Are you affected by CVE-2018-5371?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST