CVE-2018-19239

TRENDnet TEW-673GRU router (firmware v1.00b40) contains an OS command injection in the start_arpping function of the timer binary. An attacker can remotely execute commands by crafting a POST to apply.cgi and passing the parameters dhcpd_start, dhcpd_end, and lan_ipaddr. CVE-2018-19239 documents ...