Published: 18/06/2019 Updated: 18/06/2019

CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 802

Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

Cerio DT-300N 1.1.6 up to and including 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature's use of Save.cgi to execute a ping command, as exploited in the wild in October 2018.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cerio dt-300n_firmware

CERIO RCE CVE-2018-18852, authenticated (vendor defaults) web-based RCE as root user.

CERIO router Authenticated RCE (backdoor vendor creds) CVE-2018-18852 Python PoC hook-s3c (githubcom/andripwn), @andripwn on twitter Working Python PoC for CVE-2018-18852, originally appearing on; githubcom/andripwn/CVE-2018-18852 What's up CERIO Router models and variants of, DT300N, DT100G, AMR-3204, WMR-200N are vulnerable to an authenticated web-based RCE as

CERIO RCE CVE-2018-18852, authenticated (vendor defaults) web-based RCE as root user.

CERIO router Authenticated RCE (backdoor vendor creds) CVE-2018-18852 Python PoC hook-s3c (githubcom/hook-s3c), @hook_s3c on twitter Working Python PoC for CVE-2018-18852, originally appearing on; githubcom/hook-s3c/CVE-2018-18852 What's up CERIO Router models and variants of, DT300N, DT100G, AMR-3204, WMR-200N are vulnerable to an authenticated web-based RCE as

CWE-78 https://www.fortiguard.com/zeroday/FG-VD-18-149 https://nvd.nist.gov https://github.com/andripwn/CVE-2018-18852

CVE-2018-18852

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect