Published: 22/01/2018 Updated: 03/10/2019

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

An issue exists in AsusWRT prior to 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows malicious users to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.

Vulnerable Product	Search on Vulmon	Subscribe to Product
asus asuswrt

AsusWRT Router versions prior to 30043807743 suffer from an unauthenticated LAN remote code execution vulnerability ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::Udp def initialize(info = {}) super(update_info(info, ...

>> Unauthenticated LAN remote code execution in AsusWRT >> Discovered by Pedro Ribeiro (pedrib@gmailcom), Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last updated: 25/01/2018 >> Background and summary AsusWRT is the operating system used i ...

CWE-862 https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt https://blogs.securiteam.com/index.php/archives/3589 https://www.exploit-db.com/exploits/43881/https://www.exploit-db.com/exploits/44176/https://nvd.nist.gov https://packetstormsecurity.com/files/146102/AsusWRT-Router-Remote-Code-Execution.html https://www.exploit-db.com/exploits/44176/

CVE-2018-6000

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect