CVE-2018-16752

CVE-2018-16752 describes a Remote Code Execution (RCE) vulnerability in LINK-NET LW-N605R devices running firmware 12.20.2.1486. This flaw allows an authenticated attacker to execute arbitrary commands by injecting shell metacharacters into the HOST field of the ping feature within the adm/systools.asp page. While authentication is required, the widespread use of default credentials like "admin/admin" significantly lowers the barrier to exploitation. This vulnerability carries a CVSS score of 8.8 (HIGH), indicating a critical risk. It can be exploited remotely over the network with low attack complexity, requiring only low privileges, and has a high impact on confidentiality, integrity, and availability. The EPSS score of 0.498620000 suggests a moderate probability of exploitation. Currently, there is no evidence of active exploitation (not in KEV), nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, which is typical for the vast majority of CVEs.