Static firmware reverse engineering of CVE-2015-1187: unauthenticated command injection in D-Link DIR-820L. MIPS root filesystem extraction with binwalk, Ghidra analysis, and tracing the ping_addr parameter to its shell-backed execution sink.
Static firmware reverse engineering of CVE-2015-1187 in the D-Link DIR-820L using Strings, Ghidra, and Binwalk.
Done by extracting MIPS root filesystem, identifying the ncc2 backend handler, and tracing ping_addr through command construction to shell-backed execution.
This report is a static firmware reverse-engineering reproduction. It does not claim dynamic runtime validation. The finding is supported by verified firmware hashes, unpacked firmware contents, and static source-to-sink analysis.
