Vulnerability Intelligence Report
CVE-2018-18320
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:5.24%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| asuswrt-merlin_project | rt-ac5300_firmware | all |
| asuswrt-merlin_project | rt-ac5300 | all |
| asuswrt-merlin_project | rt_ac1900p_firmware | all |
| asuswrt-merlin_project | rt_ac1900p_ | all |
| asuswrt-merlin_project | rt-ac68u_firmware | all |
| asuswrt-merlin_project | rt-ac68u | all |
| asuswrt-merlin_project | rt-ac68p_firmware | all |
| asuswrt-merlin_project | rt-ac68p | all |
| asuswrt-merlin_project | rt-ac88u_firmware | all |
| asuswrt-merlin_project | rt-ac88u | all |
| asuswrt-merlin_project | rt-ac66u_b1_firmware | all |
| asuswrt-merlin_project | rt-ac66u_b1 | all |
| asuswrt-merlin_project | rt-ac56u_firmware | all |
| asuswrt-merlin_project | rt-ac56u | all |
| asuswrt-merlin_project | rt-ac3200_firmware | all |
| asuswrt-merlin_project | rt-ac3200 | all |
| asuswrt-merlin_project | rt-ac68uf_firmware | all |
| asuswrt-merlin_project | rt-ac68uf | all |
| asuswrt-merlin_project | rt-ac87_firmware | all |
| asuswrt-merlin_project | rt-ac87 | all |
| asuswrt-merlin_project | rt-ac3100_firmware | all |
| asuswrt-merlin_project | rt-ac3100 | all |
| asuswrt-merlin_project | rt-ac1900_firmware | all |
| asuswrt-merlin_project | rt-ac1900 | all |
| asuswrt-merlin_project | rt-ac86u_firmware | all |
| asuswrt-merlin_project | rt-ac86u | all |
| asuswrt-merlin_project | rt-ac2900_firmware | all |
| asuswrt-merlin_project | rt-ac2900 | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
5.244%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2018-10-15T00:00:00 |
| Published | 2018-10-15T06:00:00 |
| Last Updated | 2024-09-16T22:41:30 |
Community Chatter & Buzz