CVE-2017-11588
CriticalSummary
Cisco DDR2200 and DDR2201v1 devices are vulnerable to remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible in /PingMsg.cmd.
Risk Assessment
An attacker can remotely execute commands on the vulnerable devices, potentially leading to system takeover. This poses a serious security threat to the network.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability. Additionally, access to the device's administrative interface should be restricted.
Other vulnerabilities in Cisco DDR2200 ADSL2+ Residential Gateway, Cisco DDR2201v1 ADSL2+ Residential Gateway
See all- CVE-2017-11587High
There is a directory traversal vulnerability in the filename parameter to the /download.conf URI on Cisco DDR2200 and DDR2201v1 devices.
- CVE-2017-11589Critical
On Cisco DDR2200 and DDR2201v1 devices, there is no access control for several configuration files, which may lead to unauthorized access to sensitive information.
Original NVD description (English source)
On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible at /PingMsg.cmd.