critical9.8Public exploit code
CVE-2018-5999
An issue was discovered in AsusWRT before 3.0.0.4.384_10007.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- AsusWRT LAN - Remote Code Execution (Metasploit)2018-02-26 · remote · hardware · Verified
- AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution2018-01-22 · remote · hardware
Impact
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Asus | Asuswrt | before 3.0.0.4.384_10007 |
References
- NVD record
- CVE.org record
- https://blogs.securiteam.com/index.php/archives/3589
- https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt
- https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb
- https://www.exploit-db.com/exploits/43881/
- https://www.exploit-db.com/exploits/44176/
- https://blogs.securiteam.com/index.php/archives/3589
- https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt
- https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb
- https://www.exploit-db.com/exploits/43881/
- https://www.exploit-db.com/exploits/44176/