CVE-2018-5999

Published: Jan 22, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.

Affected (1)

Products: Asus: Asuswrt

Asus

1 product

Asuswrt

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Asus Asuswrt	Before 3.0.0.4.384_10007

References (10)

https://blogs.securiteam.com/index.php/archives/3589

Source: cve@mitre.org

ExploitTechnical DescriptionThird Party Advisory

https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/43881/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/44176/

Source: cve@mitre.org

https://blogs.securiteam.com/index.php/archives/3589