Remote Code Execution Vulnerability in LINK-NET LW-N605R Devices

CVE-2018-16752 · HIGH Severity

AV:N/AC:L/AU:S/C:C/I:C/A:C

LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.

Learn more about our Web Application Penetration Testing UK.