vendor:
LW-N605R
by:
Nassim Asrir
9.8
CVSS
HIGH
Remote Code Execution
78
CWE
Product Name: LW-N605R
Affected Version From: 12.20.2.1486
Affected Version To: 12.20.2.1486
Patch Exists: NO
Related CWE: N/A
CPE: h:link-net:lw-n605r
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: None
2018
LW-N605R 12.20.2.1486 – Remote Code Execution
LW-N605R devices allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.
Mitigation:
Ensure that the default password of admin is changed and that authentication is enabled for the ping feature.