← Vulnerability feed

Vulnerability record · CVE-2018-18852 · published 18 June 2019

CVE-2018-18852: Cerio DT-300N web PING feature OS command injection

Cerio · Dt 300n Firmware

Cerio DT-300N firmware versions 1.1.6 through 1.1.12 fail to properly validate input in the web-interface PING feature, which uses Save.cgi to run a ping command. This allows OS command injection, and the description states it was exploited in the wild in October 2018.

8.8 CVSS 3.0 High EPSS 64% · top 0.8% CWE-78 · OS command injection
8.8CVSS 3.0 base score, v2 9.0
64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature's use of Save.cgi to execute a ping command, as exploited in the wild in October 2018.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable OS command injection with confirmed in-the-wild exploitation and very high EPSS, though it requires low privileges and is not in KEV.

What it is

Cerio DT-300N firmware versions 1.1.6 through 1.1.12 fail to properly validate input in the web-interface PING feature, which uses Save.cgi to run a ping command. This allows OS command injection, and the description states it was exploited in the wild in October 2018.

Impact

An attacker can execute arbitrary OS commands on the device, gaining full control of confidentiality, integrity and availability as reflected in the CVSS impact ratings. This can lead to device takeover and use as a pivot into the network.

Attack surface

Reachable over the network through the device web interface via Save.cgi; the CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N).

Exploitation

The description states exploitation in the wild in October 2018, but the CVE is not listed in CISA KEV and no exploit tags appear in the references; EPSS is high at 0.63797 (99.183 percentile).

What to do

  • Upgrade Cerio DT-300N firmware beyond 1.1.12 if a fixed release exists; the record does not name a patched version, so confirm with the vendor.
  • Restrict access to the device web interface to trusted management networks and disable remote administration where possible.
  • Change default credentials and enforce strong authentication on the web interface.
  • Monitor and segment IoT/edge devices so a compromised DT-300N cannot reach other internal systems.

Detection

  • Inspect web server and device logs for requests to Save.cgi containing shell metacharacters or unexpected ping arguments.
  • Alert on outbound connections or command execution from the DT-300N that do not match normal device behavior.
  • Hunt for unusual processes or network traffic originating from the device following Save.cgi access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.fortiguard.com/zeroday/FG-VD-18-149 Third Party Advisory
https://www.fortiguard.com/zeroday/FG-VD-18-149 Third Party Advisory

Track CVE-2018-18852 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-53266Linux kernel ebtables SNAT out-of-bounds write in ARP rewriteThe ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA byt…KEVEPSS 0.65%analysed8.8CVE-2026-87491Google Chrome V8 out-of-bounds write enables sandbox code executionChrome before 153.0.8010.36 contains an out-of-bounds write in the V8 JavaScript engine. A crafted HTML page can trigger the memory corruption, and b…KEVEPSS 3.1%analysed9.8CVE-2025-25249Fortinet FortiOS and FortiSwitchManager heap buffer overflow via crafted packetsA heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 through 7.2.6 lets an unauthenticated…KEVEPSS 3.9%analysed7.8CVE-2026-83549SonicWall SMA1000 AMC OS Command InjectionThe SMA1000 Appliance Management Console contains an OS command injection flaw (CWE-78) that lets an authenticated administrator execute arbitrary op…KEVEPSS 11%analysed10.0CVE-2026-49869Kestra OSS auth bypass via path suffix match enables RCEKestra OSS AuthenticationFilter whitelists the public config endpoint using request.getPath().endsWith("/configs"), a suffix match instead of an exac…KEVEPSS 2.1%analysed7.8CVE-2026-53362Linux kernel IPv6 UDP paged allocation out-of-bounds write__ip6_append_data() in the Linux kernel mis-accounts fraggap on the paged-allocation path, leaving the linear skb area undersized while pagedlen is o…KEVEPSS 0.71%analysed7.8CVE-2022-0995Linux kernel watch_queue out-of-bounds writeThe Linux kernel's watch_queue event notification subsystem contains an out-of-bounds write (CWE-787) that can overwrite kernel state. A local user c…KEVEPSS 8.8%analysed8.9CVE-2026-73570Zimbra Collaboration SNMP notification OS command injectionZimbra Collaboration Suite before 10.1.20 contains an OS command injection flaw in SNMP notification processing when the optional zimbra-snmp package…KEVEPSS 12%analysed

Source: NIST National Vulnerability Database (record CVE-2018-18852), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.