PT-2019-11149 · Asus · Asuswrt-Merlin+1

Publicado

2019-11-21

·

Atualizado

2019-12-04

·

CVE-2018-8879

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Asuswrt-Merlin firmware versions prior to 384.4 ASUS firmware versions prior to 3.0.0.4.382.50470
Description: The issue allows remote attackers to execute arbitrary code by providing a long string to the "blocking.asp" page via a GET or POST request. Vulnerable parameters are flag, mac, and cat id.
Recommendations: For Asuswrt-Merlin firmware versions prior to 384.4, update to version 384.4 or later. For ASUS firmware versions prior to 3.0.0.4.382.50470, update to version 3.0.0.4.382.50470 or later. As a temporary workaround, consider restricting access to the "blocking.asp" page to minimize the risk of exploitation. Avoid using the parameters flag, mac, and cat id in the affected page until the issue is resolved.

Exploit

Correção

Memory Corruption

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2018-8879

Produtos afetados

Asus
Asuswrt-Merlin