CVE-2018-18319

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-10-15

Last modified

2024-09-16

Weaknesses

CWE-94

Affected products

• Rt-ac1900 Firmware (Asuswrt-merlin Project)
• Rt-ac2900 Firmware (Asuswrt-merlin Project)
• Rt-ac3100 Firmware (Asuswrt-merlin Project)
• Rt-ac3200 Firmware (Asuswrt-merlin Project)
• Rt-ac5300 Firmware (Asuswrt-merlin Project)
• Rt-ac56u Firmware (Asuswrt-merlin Project)
• Rt-ac66u B1 Firmware (Asuswrt-merlin Project)
• Rt-ac68p Firmware (Asuswrt-merlin Project)
• Rt-ac68u Firmware (Asuswrt-merlin Project)
• Rt-ac68uf Firmware (Asuswrt-merlin Project)
• Rt-ac86u Firmware (Asuswrt-merlin Project)
• Rt-ac87 Firmware (Asuswrt-merlin Project)
• Rt-ac88u Firmware (Asuswrt-merlin Project)
• Rt Ac1900p Firmware (Asuswrt-merlin Project)

References

• http://blog.51cto.com/010bjsoft/2298902
• https://github.com/qoli/Merlin.PHP/issues/27