PT-2018-14404 · Asuswrt Merlin · Merlin.Php

Ly55521 · Publicado 2018-10-15 · Atualizado 2024-08-05 · CVE-2018-18320

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Merlin.PHP version 0.6.6

Description An issue was discovered in the Merlin.PHP component for Asuswrt-Merlin devices, allowing an attacker to execute arbitrary commands due to a popen call in exec.php. The vendor notes that Merlin.PHP is designed for use on a trusted intranet network and intentionally allows remote code execution.

Recommendations For Merlin.PHP version 0.6.6, consider restricting access to exec.php to minimize the risk of exploitation, as the component is intended for use on a trusted intranet network. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2018-18320

Produtos afetados

Merlin.Php

Referências · 5

• 🔥 https://github.com/qoli/Merlin.PHP/issues/26 · Exploit
• 🔥 http://blog.51cto.com/010bjsoft/2298828 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18320 · Nota de Segurança
• https://t.me/cvenotify/89185 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-18320 · Aviso do Fabricante