vendor:
AsusWRT
by:
Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
9.8
CVSS
CRITICAL
HTTP server authentication bypass, Command injection in the HTTP server
78, 94
CWE
Product Name: AsusWRT
Affected Version From: v3.0.0.4.380.7743
Affected Version To: v3.0.0.4.384.10007
Patch Exists: YES
Related CWE: CVE-2018-5999, CVE-2018-6000
CPE: o:asus:asuswrt
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Linux
2018
Unauthenticated LAN remote code execution in AsusWRT
The AsusWRT HTTP server has a flaw in handle_request() that allows an unauthenticated user to perform a POST request for certain actions. This means that an unauthenticated user can perform a POST request to the router, and the router will execute the code in the handler->input() function. The AsusWRT HTTP server has a command injection vulnerability in the handle_request() function. This means that an unauthenticated user can perform a POST request to the router, and the router will execute the code in the doSystem() function.
Mitigation:
Update to the latest version of AsusWRT
