critical9.8
CVE-2018-18319
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices.
Impact
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Asuswrt-Merlin Project | Rt-Ac5300 Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt Ac1900p Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac68u Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac68p Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac88u Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac66u B1 Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac56u Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac3200 Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac68uf Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac87 Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac3100 Firmware | through 380.70 |
| Asuswrt-Merlin Project | Rt-Ac1900 Firmware | through 380.70 |