ZeroDay Findings
Sign inSign up

Findings

CVE-2015-1187

D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability

Published Sep 21, 2017 · updated Jun 16, 2026 · dlink dir-626l firmware

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 21, 2017 · Catalog

    Detected

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date Apr 15, 2022

Affected

  • cpe dlink/dir-626l firmware1.04
  • cpe dlink/dir-636l firmware1.04
  • cpe dlink/dir-808l firmware1.03
  • cpe dlink/dir-810l firmware1.01
  • cpe dlink/dir-810l firmware2.02
  • cpe dlink/dir-820l firmware1.02
  • cpe dlink/dir-820l firmware1.05
  • cpe dlink/dir-820l firmware2.01
  • cpe dlink/dir-826l firmware1.00
  • cpe dlink/dir-830l firmware1.00
  • cpe dlink/dir-836l firmware1.01
  • cpe trendnet/tew-731br firmware2.01
  • vendor D-Link and TRENDnet Multiple Devicesversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2015-1187

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2015-1187

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2015-1187

    30-day exploitation probability 82.9%

    first.org
  • Exploit DatabasePublic exploit reference41677

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_linux/http/multi_ncc_ping_exec

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2015-1187

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References