CVE-2015-1187 : The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to

Products affected by CVE-2015-1187

Dlink » Dir-820l Firmware » Version: 1.05 Update B03
cpe:2.3:o:dlink:dir-820l_firmware:1.05:b03:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-820l » Version: N/A
Dlink » Dir-820l Firmware » Version: 1.02 Update B10
cpe:2.3:o:dlink:dir-820l_firmware:1.02:b10:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-820l » Version: N/A
Dlink » Dir-820l Firmware » Version: 2.01 Update B02
cpe:2.3:o:dlink:dir-820l_firmware:2.01:b02:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-820l » Version: N/A
Dlink » Dir-826l Firmware » Version: 1.00 Update B23
cpe:2.3:o:dlink:dir-826l_firmware:1.00:b23:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-826l » Version: N/A
Dlink » Dir-830l Firmware » Version: 1.00 Update B07
cpe:2.3:o:dlink:dir-830l_firmware:1.00:b07:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-830l » Version: N/A
Dlink » Dir-836l Firmware » Version: 1.01 Update B03
cpe:2.3:o:dlink:dir-836l_firmware:1.01:b03:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-836l » Version: N/A
Dlink » Dir-810l Firmware » Version: 1.01 Update B04
cpe:2.3:o:dlink:dir-810l_firmware:1.01:b04:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-810l » Version: N/A
Dlink » Dir-810l Firmware » Version: 2.02 Update B01
cpe:2.3:o:dlink:dir-810l_firmware:2.02:b01:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-810l » Version: N/A
Dlink » Dir-626l Firmware » Version: 1.04 Update B04
cpe:2.3:o:dlink:dir-626l_firmware:1.04:b04:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-626l » Version: N/A
Dlink » Dir-636l Firmware » Version: 1.04
cpe:2.3:o:dlink:dir-636l_firmware:1.04:*:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-636l » Version: N/A
Dlink » Dir-651 Firmware » Version: 1.10na Update B02
cpe:2.3:o:dlink:dir-651_firmware:1.10na:b02:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-651 » Version: N/A
Dlink » Dir-808l Firmware » Version: 1.03 Update B05
cpe:2.3:o:dlink:dir-808l_firmware:1.03:b05:*:*:*:*:*:*
Matching versions
When used together with: Dlink » Dir-808l » Version: N/A
Trendnet » Tew-731br Firmware » Version: 2.01 Update B01
cpe:2.3:o:trendnet:tew-731br_firmware:2.01:b01:*:*:*:*:*:*
Matching versions
When used together with: Trendnet » Tew-731br » Version: N/A
Trendnet » Tew-651br Firmware » Version: N/A
cpe:2.3:o:trendnet:tew-651br_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Trendnet » Tew-651br » Version: N/A
Trendnet » Tew-652br Firmware » Version: N/A
cpe:2.3:o:trendnet:tew-652br_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Trendnet » Tew-652br » Version: N/A
Trendnet » Tew-711br Firmware » Version: 1.00 Update B31
cpe:2.3:o:trendnet:tew-711br_firmware:1.00:b31:*:*:*:*:*:*
Matching versions
When used together with: Trendnet » Tew-711br » Version: N/A
Trendnet » Tew-810dr Firmware » Version: 1.00 Update B19
cpe:2.3:o:trendnet:tew-810dr_firmware:1.00:b19:*:*:*:*:*:*
Matching versions
When used together with: Trendnet » Tew-810dr » Version: N/A
Trendnet » Tew-813dru Firmware » Version: 1.00 Update B23
cpe:2.3:o:trendnet:tew-813dru_firmware:1.00:b23:*:*:*:*:*:*
Matching versions
When used together with: Trendnet » Tew-813dru » Version: N/A

CVE-2015-1187 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability

CISA required action:

The impacted product is end-of-life and should be disconnected if still in use.

CISA description:

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2015-1187

Added on 2022-03-25 Action due date 2022-04-15

Exploit prediction scoring system (EPSS) score for CVE-2015-1187

EPSS FAQ

78.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2015-1187

D-Link/TRENDnet NCC Service Command Injection

Disclosure Date: 2015-02-26

First seen: 2020-04-26

exploit/linux/http/multi_ncc_ping_exec

This module exploits a remote command injection vulnerability on several routers. The vulnerability exists in the ncc service, while handling ping commands. This module has been tested on a DIR-626L emulated environment. Several D-Link and TRENDnet devices are report

More information

CVSS scores for CVE-2015-1187

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0	2025-02-07
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-1187

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2015-1187

https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2

secpub/Multivendor/ncc2 at master · darkarnium/secpub · GitHub
Issue Tracking;Mitigation;Third Party Advisory;Broken Link
http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.html

D-Link DIR636L Remote Command Injection ≈ Packet Storm
Issue Tracking;Third Party Advisory;VDB Entry
http://seclists.org/fulldisclosure/2015/Mar/15

Full Disclosure: CVE-2015-1187: D-Link DIR-636L Remote Command Injection - Incorrect Authentication
Issue Tracking;Mailing List;Third Party Advisory
http://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.html

D-Link/TRENDnet NCC Service Command Injection ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/72848

D-Link DIR-636L CVE-2015-1187 Remote Command Injection and Authentication Bypass Vulnerabilities
Third Party Advisory;VDB Entry;Broken Link
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052

D-Link Technical Support
Vendor Advisory

Vulnerability Details : CVE-2015-1187