PT-2021-16801 · Mercusys · Mercusys Mercury X18G

Published 2021-04-29 · Updated 2021-05-08 · CVE-2021-25811

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MERCUSYS Mercury X18G version 1.0.5

Description The issue allows for denial of service via a crafted value to the listen http lan parameter. After the device restarts following exploitation, it cannot access the web server unless the listen http lan parameter in uhttpd.json is manually fixed.

Recommendations For MERCUSYS Mercury X18G version 1.0.5, manually fix the listen http lan parameter in uhttpd.json to restore web server access. As a temporary workaround, consider avoiding the use of the listen http lan parameter until a patch is available.

Fix

Related Identifiers

CVE-2021-25811

Affected Products

Mercusys Mercury X18G

References · 5

• https://mercurycom.com.cn/product-521-1.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25811 · Security Note
• https://mercusys.com/en · Vendor Advisory
• ❌ https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Denial%20of%20Service.md · Note, Deleted