CVE:CVE-2017-11587
CNNVD:CNNVD-201707-1048
Cisco DDR2200 ADSL2+ Residential Gateway和DDR2201v1 ADSL2+ Residential Gateway都是美国思科（Cisco）公司的家用无线网关设备。
Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E版本和DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3版本中存在目录遍历漏洞。攻击者可通过向waitPingqry.cgi URL中发送带有shell元字符的‘pingAddr’参数利用该漏洞下载任意的系统文件。
solution:Upgrade cisco residential_gateway_firmware to a higher version than ddr2200b-na-annexa-fcc-v00.00.03.45.4e,ddr2201v1-na-annexa-fcc-v00.00.03.28.3,and avoid the version ddr2200b-na-annexa-fcc-v00.00.03.45.4e,ddr2201v1-na-annexa-fcc-v00.00.03.28.3