christopher-leese/cve-2015-1187-dir820l-firmware-reverse-engineering

PoC

Independent reverse engineering and reproduction of CVE-2015-1187, an unauthenticated command injection in the D-Link DIR-820L (Rev A, v1.05B03). MIPS firmware extraction with binwalk, static analysis in Ghidra, and tracing the `ping_addr` parameter to its command-execution sink.

view exploit source poc_in_githubauthor christopher-leesepublished 2026-06-30catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2015-1187UScritical9.8OT criticalKEV
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan