CVE-2015-6024

Critical

Published: 09/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In NetCommWireless HSPA 3G10WVE wireless routers with firmware before version 3G10WVE-L101-S306ETS-C01_R05, the ping.cgi script allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIA_IPADDRESS parameter.

Risk Assessment

This vulnerability may lead to unauthorized access and execution of malicious code, posing a serious threat to the organization's network security.

Recommendation

It is recommended to update the router firmware to the latest version to mitigate this vulnerability and restrict access to the administrative interface to trusted users.

Original NVD description (English source)

ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIA_IPADDRESS parameter.