PT-2019-9049 · Asus · Asus Rt-Ac3200

Published 2019-05-13 · Updated 2024-09-05 · CVE-2018-14714

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASUS RT-AC3200 version 3.0.0.4.382.50010

Description The issue allows attackers to execute system commands via the "load script" URL parameter in the appGet.cgi file. This can be exploited by sending a malicious request to the "/appGet.cgi" endpoint with a crafted load script parameter.

Recommendations For version 3.0.0.4.382.50010, avoid using the load script parameter in the appGet.cgi file until a patch is available. As a temporary workaround, consider restricting access to the appGet.cgi file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2018-14714

Affected Products

Asus Rt-Ac3200

References · 7

• 🔥 https://github.com/BTtea/CVE-2018-14714-RCE-exploit · Exploit
• 🔥 https://github.com/sunn1day/CVE-2018-14714-POC · Exploit
• 🔥 https://github.com/tin-z/CVE-2018-14714-POC · Exploit
• 🔥 https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14714 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14714 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/11085 · Telegram Post