CVE-2015-1187: D-Link and TRENDnet ping tool command injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score, KEV listing and near-maximum EPSS probability on end-of-life devices.

What it is

The ping tool in multiple D-Link and TRENDnet router and access point firmware fails to properly authenticate or sanitize the ping_addr parameter passed to ping.ccp, allowing command injection. Because the flaw is reachable over the network without credentials, it exposes affected devices to full remote code execution.

Impact

An unauthenticated remote attacker can execute arbitrary commands on the device, gaining full control of confidentiality, integrity and availability. This can lead to router takeover, traffic interception and use of the device as a foothold in the network.

Attack surface

Reachable over the network via the ping.ccp endpoint and the ping_addr parameter; the CVSS vector shows no privileges or user interaction required. The CWE-287 classification indicates improper authentication on that interface.

Exploitation

CVE-2015-1187 is listed in CISA KEV with a 2022-03-25 addition date, and EPSS shows a 30-day probability of 0.82863 (99.65th percentile). Public exploit references are tagged Exploit, confirming working exploit code exists.

What to do

• Apply the vendor advisory SAP10052 fix if a supported firmware exists; otherwise treat the device as end-of-life.
• Per CISA KEV guidance, disconnect end-of-life affected D-Link and TRENDnet devices from the network.
• Block or restrict access to ping.ccp and the device management interface from untrusted networks.
• Replace affected models with supported hardware that receives security updates.
• Segment any remaining devices on an isolated management VLAN with no internet exposure.

Detection

• Monitor HTTP requests to ping.ccp with suspicious or shell metacharacter content in the ping_addr parameter.
• Alert on outbound connections or command execution activity originating from router and access point management IPs.
• Inventory D-Link and TRENDnet devices matching the affected firmware model list and flag any still reachable from untrusted networks.
• Review device logs for unexpected ping or diagnostic invocations and for authentication bypass patterns on the management interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.