CVE-2017-11588

Critical

Published: 24/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Cisco DDR2200 and DDR2201v1 devices are vulnerable to remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible in /PingMsg.cmd.

Risk Assessment

An attacker can remotely execute commands on the vulnerable devices, potentially leading to system takeover. This poses a serious security threat to the network.

Recommendation

It is recommended to update the device firmware to the latest version to mitigate this vulnerability. Additionally, access to the device's administrative interface should be restricted.

Original NVD description (English source)

On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible at /PingMsg.cmd.