PT-2019-11149 · Asus · Asuswrt-Merlin+1

Published 2019-11-21 · Updated 2019-12-04 · CVE-2018-8879

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Asuswrt-Merlin firmware versions prior to 384.4 ASUS firmware versions prior to 3.0.0.4.382.50470

Description: The issue allows remote attackers to execute arbitrary code by providing a long string to the "blocking.asp" page via a GET or POST request. Vulnerable parameters are flag, mac, and cat id.

Recommendations: For Asuswrt-Merlin firmware versions prior to 384.4, update to version 384.4 or later. For ASUS firmware versions prior to 3.0.0.4.382.50470, update to version 3.0.0.4.382.50470 or later. As a temporary workaround, consider restricting access to the "blocking.asp" page to minimize the risk of exploitation. Avoid using the parameters flag, mac, and cat id in the affected page until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-8879

Affected Products

Asus

Asuswrt-Merlin

References · 4

• 🔥 https://pagedout.institute/download/PagedOut_001_beta1.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-8879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8879 · Security Note
• https://asus.com/Networking/RTAC66U/HelpDesk_BIOS · Note