CVE-2018-15887

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Main_Analysis_Content.asp in ASUS DSL-N12E_C1 1.1.2.3_345 is prone to Authenticated Remote Command Execution, which allows a remote attacker to execute arbitrary OS commands via service parameters, such as shell metacharacters in the destIP parameter of a cmdMethod=ping request.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://fakhrizulkifli.github.io/CVE-2018-15887.htmlExploit, Third Party Advisory
https://fakhrizulkifli.github.io/CVE-2018-15887.htmlExploit, Third Party Advisory

Timeline

Published: Aug 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-158889.8An issue was discovered in ASPCMS 2.5.6. When registering ordinary users in the addUser function of the /member/reg.asp page, they can be re CVE-2018-158909.8An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in CVE-2018-158914.8An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an CVE-2018-158924.3FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.CVE-2018-158939.8A SQL injection was discovered in /coreframe/app/admin/copyfrom.php in WUZHI CMS 4.1.0 via the index.php?m=core&f=copyfrom&v=listing keyword CVE-2018-158949.8A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyV CVE-2018-158957.5An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not blo CVE-2018-158965.4PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.CVE-2018-158976.5PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First N CVE-2018-158985.9The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate, which might CVE-2018-158996.1An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability.CVE-2018-159018.8e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.