Skip to content

CVE-2017-11588 On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is remote command exec...

CriticalCVSS 9.8 EPSS 4.2%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible at /PingMsg.cmd.

Affected products

ProductAffected versionsFixed in
cisco residential gateway firmware = ddr2200b-na-annexa-fcc-v00.00.03.45.4e No fix listed
cisco residential gateway firmware = ddr2201v1-na-annexa-fcc-v00.00.03.28.3 No fix listed

References

  • seclists.org mailing-list third-party-advisory
  • 99963 third-party-advisory vdb-entry