Read the docs
TI-2018-11995 Aliases CVE-2018-16752GHSA-87v6-vw3p-5g5r

LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via…

Priority HIGH 67CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.

Why it matters now

EPSS 0.42657 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:linknet-usa:lw-n605r_firmware:12.20.2.1486:*:*:*:*:*:*:*12.20.2.1486VulnerableLinknet-usa
cpe:2.3:h:linknet-usa:lw-n605r:-:*:*:*:*:*:*:*not specified by NVDRunning onLinknet-usa
  • cpe:2.3:o:linknet-usa:lw-n605r_firmware:12.20.2.1486:*:*:*:*:*:*:* Versions 12.20.2.1486 Vulnerable ·Linknet-usa
  • cpe:2.3:h:linknet-usa:lw-n605r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linknet-usa

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-16752
  2. 2026-10-03 Alias added: GHSA-87v6-vw3p-5g5r

References

Exploit 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences