CVE-2018-18319

Published: Oct 15, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution

Affected (14)

Products: Asuswrt Merlin Project: Rt Ac5300 Firmware, Rt Ac1900p Firmware, Rt Ac68u Firmware, Rt Ac68p Firmware, Rt Ac88u Firmware, Rt Ac66u B1 Firmware, Rt Ac56u Firmware, Rt Ac3200 Firmware, Rt Ac68uf Firmware, Rt Ac87 Firmware, Rt Ac3100 Firmware, Rt Ac1900 Firmware, Rt Ac86u Firmware, Rt Ac2900 Firmware

Asuswrt Merlin Project

14 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac5300 Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac5300	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac1900p Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac1900p	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac68u Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac68u	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac68p Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac68p	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac88u Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac88u	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac66u B1 Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac66u B1	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac56u Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac56u	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac3200 Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac3200	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac68uf Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac68uf	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac87 Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac87	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac3100 Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac3100	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac1900 Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac1900	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac86u Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac86u	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asuswrt Merlin Project Rt Ac2900 Firmware	Up to 380.70

Running on/with	Platform Versions
Asuswrt Merlin Project Rt Ac2900	All versions

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

http://blog.51cto.com/010bjsoft/2298902

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/qoli/Merlin.PHP/issues/27

Source: cve@mitre.org

ExploitThird Party Advisory

http://blog.51cto.com/010bjsoft/2298902

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/qoli/Merlin.PHP/issues/27

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.