PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-6024 Netcommwireless CVE debrief

CVE-2015-6024 is a critical command-injection issue in NetCommWireless HSPA 3G10WVE router firmware affecting ping.cgi. The supplied description says remote authenticated users can trigger arbitrary command execution by injecting shell metacharacters into DIA_IPADDRESS. Because this is on a router management path, exposed or weakly protected admin access can translate into full device compromise.

Vendor
Netcommwireless
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

Organizations still running NetCommWireless HSPA 3G10WVE routers, especially environments with legacy firmware, remote administration enabled, or multiple branch/edge devices managed by small IT teams or MSPs.

Technical summary

The vulnerable CGI handler accepts unsanitized DIA_IPADDRESS input and passes it in a way that permits shell metacharacter injection, which aligns with CWE-77. The supplied record says affected firmware is before 3G10WVE-L101-S306ETS-C01_R05, and the NVD CPE mapping also flags 3G10WVE-L101-S306ETS-C01_R03 as vulnerable. The CVSS vector in the supplied record is inconsistent with the narrative because it rates the issue as network-exploitable without privileges, while the text says remote authenticated users.

Defensive priority

Critical: prioritize immediate review, patching, or isolation of affected devices.

Recommended defensive actions

  • Identify all NetCommWireless HSPA 3G10WVE devices and confirm exact firmware versions.
  • Upgrade any affected firmware to 3G10WVE-L101-S306ETS-C01_R05 or later if supported.
  • Restrict management interface exposure to trusted networks only.
  • Require strong administrator authentication and remove unused admin accounts.
  • If patching is not possible, segment or isolate the device and place compensating controls around management access.
  • Review logs and configuration changes on exposed devices for signs of unauthorized command execution.

Evidence notes

Supplied NVD text identifies ping.cgi in NetCommWireless HSPA 3G10WVE firmware and cites shell metacharacter injection in DIA_IPADDRESS, classified as CWE-77. The NVD references include Packet Storm, Full Disclosure, SecurityFocus archives, and Exploit-DB entries, indicating public disclosure materials. The supplied data also shows a version-scope mismatch: the description says firmware before 3G10WVE-L101-S306ETS-C01_R05, while the NVD CPE entry specifically marks 3G10WVE-L101-S306ETS-C01_R03 as vulnerable. The CVSS vector in the supplied record conflicts with the wording about remote authenticated users, so access assumptions should be verified against deployment reality.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-6024 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-6024

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-6024 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-6024

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.