PT-2018-13271 · Asus · Asus Dsl-N12E C1
Published
2018-08-27
·
Updated
2018-11-05
·
CVE-2018-15887
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ASUS DSL-N12E C1 version 1.1.2.3 345
Description
The issue allows a remote attacker to execute arbitrary OS commands via service parameters. This can be achieved by using shell metacharacters in the
destIP parameter of a cmdMethod=ping request to the "Main Analysis Content.asp" page.Recommendations
For version 1.1.2.3 345, as a temporary workaround, consider restricting access to the
Main Analysis Content.asp page and avoid using the destIP parameter in cmdMethod=ping requests until a patch is available.Exploit
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Asus Dsl-N12E C1