Published: 22/01/2018 Updated: 03/10/2019

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

An issue exists in AsusWRT prior to 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.

Vulnerable Product	Search on Vulmon	Subscribe to Product
asus asuswrt

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::Udp def initialize(info = {}) super(update_info(info, ...

>> Unauthenticated LAN remote code execution in AsusWRT >> Discovered by Pedro Ribeiro (pedrib@gmailcom), Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last updated: 25/01/2018 >> Background and summary AsusWRT is the operating system used i ...

AsusWRT Router versions prior to 30043807743 suffer from an unauthenticated LAN remote code execution vulnerability ...

NVD-CWE-noinfo https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt https://blogs.securiteam.com/index.php/archives/3589 https://www.exploit-db.com/exploits/43881/https://www.exploit-db.com/exploits/44176/https://nvd.nist.gov https://www.exploit-db.com/exploits/44176/

CVE-2018-5999

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect