cve/2018/CVE-2018-16752.md

CVE-2018-16752

Description

LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.

POC

Reference

• http://packetstormsecurity.com/files/149297/LW-N605R-Remote-Code-Execution.html
• https://www.exploit-db.com/exploits/45351/

Github

• https://github.com/HimmelAward/Goby_POC
• https://github.com/Z0fhack/Goby_POC