CVE-2015-1187
published 2017-09-21CVE-2015-1187: The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
PriorityP195critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
82.86%
99.6th percentile
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-626l_firmware | — | — |
| dlink | dir-636l_firmware | — | — |
| dlink | dir-651_firmware | — | — |
| dlink | dir-808l_firmware | — | — |
| dlink | dir-810l_firmware | — | — |
| dlink | dir-810l_firmware | — | — |
| dlink | dir-820l_firmware | — | — |
| dlink | dir-820l_firmware | — | — |
| dlink | dir-820l_firmware | — | — |
| dlink | dir-826l_firmware | — | — |
| dlink | dir-830l_firmware | — | — |
| dlink | dir-836l_firmware | — | — |
| trendnet | tew-711br_firmware | — | — |
| trendnet | tew-731br_firmware | — | — |
| trendnet | tew-810dr_firmware | — | — |
| trendnet | tew-813dru_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> $HOME_NET any (msg:"ET EXPLOIT D-Link TRENDnet NCC Service Command Injection Attempt (CVE-2015-1187)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ping.cpp"; endswith; http.request_body; content:"&ping_addr=|24 28|"; fast_pattern; reference:url,www.fortinet.com/blog/threat-research/Iz1h9-campaign-enhances-arsenal-with-scores-of-exploits; reference:cve,2015-1187; classtype:attempted-admin; sid:2049118; rev:2; metadata:affected_product D_Link, attack_target Networking_Equipment, created_at 2023_11_08, cve CVE_2015_1187, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2024_05_22, reviewed_at 2023_11_08, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services;)
bytes
|24 28|
- →Exploit sends HTTP POST to /ping.ccp (or /ping.cpp per Snort rule) with ccp_act=ping_v6 and ping_addr parameter containing a shell command substitution starting with $( — detect POST requests to this URI with body containing &ping_addr=$( or the hex equivalent |24 28| ↗
- →Vulnerable devices respond with HTTP 500 and a Server header matching mini_httpd — use this to fingerprint/detect affected devices during reconnaissance ↗
- →Post-exploitation payload is dropped to /tmp as a randomly named ELF binary, then chmod 777'd and executed — monitor for new executable files created in /tmp on MIPS Linux devices ↗
- →Exploit uses ${IFS} as a space substitute in shell commands to evade simple string-matching — detect wget or chmod commands in HTTP POST bodies using ${IFS} as delimiter ↗
- →Targets Linux MIPS (little-endian and big-endian) architectures — payload retrieval via wget from attacker-controlled server; monitor outbound wget requests from router management IPs ↗
- ·The Snort rule targets /ping.cpp (with a 'p') while the CVE and Metasploit module reference /ping.ccp (with a 'c') — ensure detection coverage includes both URI variants to avoid blind spots ↗
- ·The Metasploit module was only tested on a DIR-626L emulated environment; exploitation behavior on other listed affected devices (DIR-636L, DIR-808L, DIR-810L, DIR-820L, DIR-826L, DIR-830L, DIR-836L, TEW-731BR) may differ ↗
- ·All affected products are end-of-life per CISA; no vendor patch is available — detection/blocking is the only mitigation for devices still in use ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
cisa·2022-03-25·CVSS 9.8
CVE-2015-1187 [CRITICAL] CWE-287 D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
Vulnerability: D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
Affected: D-Link and TRENDnet Multiple Devices
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2015-1187
Remediation Due Date: 2022-04-15
GHSA
GHSA-2cvq-m957-r86c: The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping
ghsa_unreviewed·2022-05-17
CVE-2015-1187 [CRITICAL] CWE-287 GHSA-2cvq-m957-r86c: The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
VulnCheck
D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
vulncheck·2015·CVSS 9.8
CVE-2015-1187 [CRITICAL] CWE-287 D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.
Affected: D-Link and TRENDnet Multiple Devices
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Exploitation References: https://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html; https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.fortinet.com/blog/threat-research/Iz1h9-campaign-enhances-arsenal-with-scores-of-exploits; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-09-23&host_type=s
Suricata
ET EXPLOIT D-Link TRENDnet NCC Service Command Injection Attempt (CVE-2015-1187)
suricata·2023-11-08·CVSS 9.8
CVE-2015-1187 [CRITICAL] ET EXPLOIT D-Link TRENDnet NCC Service Command Injection Attempt (CVE-2015-1187)
ET EXPLOIT D-Link TRENDnet NCC Service Command Injection Attempt (CVE-2015-1187)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT D-Link TRENDnet NCC Service Command Injection Attempt (CVE-2015-1187)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ping.cpp"; endswith; http.request_body; content:"&ping_addr=|24 28|"; fast_pattern; reference:url,www.fortinet.com/blog/threat-research/Iz1h9-campaign-enhances-arsenal-with-scores-of-exploits; reference:cve,2015-1187; classtype:attempted-admin; sid:2049118; rev:2; metadata:affected_product D_Link, attack_target Networking_Equipment, created_at 2023_11_08, cve CVE_2015_1187, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2024_05_22, reviewed_a
Exploit-DB
D-Link/TRENDnet - NCC Service Command Injection (Metasploit)
exploitdb·2015-02-26
CVE-2015-1187 D-Link/TRENDnet - NCC Service Command Injection (Metasploit)
D-Link/TRENDnet - NCC Service Command Injection (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class MetasploitModule 'D-Link/TRENDnet NCC Service Command Injection',
'Description' => %q{
This module exploits a remote command injection vulnerability on several routers. The
vulnerability exists in the ncc service, while handling ping commands. This module has
been tested on a DIR-626L emulated environment. Several D-Link and TRENDnet devices
are reported as affected, including: D-Link DIR-626L (Rev A) v1.04b04, D-Link DIR-636L
(Rev A) v1.04, D-Link DIR-808L (Rev A) v1.03b05, D-Link DIR-810L (Rev A) v1.01b04, D-Link
DIR-810L (Rev B) v2.02b01, D-Link DIR-820L (Rev
Metasploit
D-Link/TRENDnet NCC Service Command Injection
metasploit
D-Link/TRENDnet NCC Service Command Injection
D-Link/TRENDnet NCC Service Command Injection
This module exploits a remote command injection vulnerability on several routers. The vulnerability exists in the ncc service, while handling ping commands. This module has been tested on a DIR-626L emulated environment. Several D-Link and TRENDnet devices are reported as affected, including: D-Link DIR-626L (Rev A) v1.04b04, D-Link DIR-636L (Rev A) v1.04, D-Link DIR-808L (Rev A) v1.03b05, D-Link DIR-810L (Rev A) v1.01b04, D-Link DIR-810L (Rev B) v2.02b01, D-Link DIR-820L (Rev A) v1.02B10, D-Link DIR-820L (Rev A) v1.05B03, D-Link DIR-820L (Rev B) v2.01b02, D-Link DIR-826L (Rev A) v1.00b23, D-Link DIR-830L (Rev A) v1.00b07, D-Link DIR-836L (Rev A) v1.01b03 and TRENDnet TEW-731BR (Rev 2) v2.01b01
Bleepingcomputer
Mirai DDoS malware variant expands targets with 13 router exploits
blogs_bleepingcomputer·2023-10-10·CVSS 9.8
[CRITICAL] Mirai DDoS malware variant expands targets with 13 router exploits
## Mirai DDoS malware variant expands targets with 13 router exploits
## Bill Toulas
A Mirai-based DDoS (distributed denial of service) malware botnet tracked as IZ1H9 has added thirteen new payloads to target Linux-based routers and routers from D-Link, Zyxel, TP-Link, TOTOLINK, and others.
Fortinet researchers report observing a peak in the exploitation rates around the first week of September, reaching tens of thousands of exploitation attempts against vulnerable devices.
IZ1H9 compromises devices to enlist them to its DDoS swarm and then launches DDoS attacks on specified targets, presumably on the order of clients renting its firepower.
## Extensive IoT targeting
The more devices and vulnerabilities targeted by a DDoS malware increased the potential to build a large and powerful
Fortinet
IZ1H9 Campaign Enhances Its Arsenal with Scores of Exploits | FortiGuard Labs
blogs_fortinet·2023-10-09·CVSS 9.8
[CRITICAL] IZ1H9 Campaign Enhances Its Arsenal with Scores of Exploits | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
IZ1H9 Campaign Enhances Its Arsenal with Scores of Exploits
By Cara Lin | October 09, 2023
Affected Platforms: Linux
Impacted Users: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: Critical
In September 2023, our FortiGuard Labs team observed that the IZ1H9 Mirai-based DDoS campaign has aggressively updated its arsenal of exploits. Thirteen payloads were included in this variant, including D-Link devices, Netis wireless router, Sunhillo SureLine, Geutebruck IP camera, Yealink Device Management, Zyxel devices, TP-Link Archer, Korenix Jetwave, and TOTOLINK routers.
Based on the trigger counts recorded by our IPS signatures, it is evident that peak exploitation occurred on September 6, with trigger counts ran
Unit42
Two New IoT Vulnerabilities Identified with Mirai Payloads
blogs_unit42·2020-10-14
Two New IoT Vulnerabilities Identified with Mirai Payloads
Threat Research Center
Threat Research
Vulnerabilities
## Two New IoT Vulnerabilities Identified with Mirai Payloads
Ken Hsu
Yue Guan
Vaibhav Singhal
Qi Deng
Published: October 14, 2020
Threat Research
Vulnerabilities
IoT
Mirai
## Executive Summary
Palo Alto Networks is proactively trying to safeguard its customers from attacks however possible. By leveraging its Next-Generation Firewall as sensors on the perimeter to detect malicious payloads and attack patterns, Unit 42 researchers are able to hunt down the menaces out there on the network, be they known or not.
Unit 42 researchers have taken a closer look at four Mirai variants from two recently discovered campaigns leveraging command injection vulnerability exploits that reveal a familiar IoT attack pattern.
While t
Unit42
Two New IoT Vulnerabilities Identified with Mirai Payloads
blogs_unit42·2020-10-14
Two New IoT Vulnerabilities Identified with Mirai Payloads
## Executive Summary
Palo Alto Networks is proactively trying to safeguard its customers from attacks however possible. By leveraging its Next-Generation Firewall as sensors on the perimeter to detect malicious payloads and attack patterns, Unit 42 researchers are able to hunt down the menaces out there on the network, be they known or not.
Unit 42 researchers have taken a closer look at four Mirai variants from two recently discovered campaigns leveraging command injection vulnerability exploits that reveal a familiar IoT attack pattern.
While this generic approach allows researchers to observe the entire killchain and even acquire the malware binary from the attack, this post-exploitation heuristic does have its caveat: the traffic fingerprinting. Similar services yield similar traffi
http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.htmlhttp://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Mar/15http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052http://www.securityfocus.com/bid/72848https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.htmlhttp://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Mar/15http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052http://www.securityfocus.com/bid/72848https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1187
2017-09-21
Published
2022-03-25
Added to CISA KEV
Exploited in the wild