Vulnerability Intelligence Report
CVE-2018-9285
Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices before 3.0.0.4.382.39935; RT-AC87U and RT-AC3200 devices before 3.0.0.4.382.50010; and RT-AC5300 devices before 3.0.0.4.384.20287 allows OS command injection via the pingCNT and destIP fields of the SystemCmd variable.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:3.61%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| asus | rt-ac66u_firmware | all |
| asus | rt-ac66u | all |
| asus | rt-ac68u_firmware | all |
| asus | rt-ac68u | all |
| asus | rt-ac86u_firmware | all |
| asus | rt-ac86u | all |
| asus | rt-ac88u_firmware | all |
| asus | rt-ac88u | all |
| asus | rt-ac1900_firmware | all |
| asus | rt-ac1900 | all |
| asus | rt-ac2900_firmware | all |
| asus | rt-ac2900 | all |
| asus | rt-ac3100_firmware | all |
| asus | rt-ac3100 | all |
| asus | rt-n18u_firmware | all |
| asus | rt-n18u | all |
| asus | rt-ac87u_firmware | all |
| asus | rt-ac87u | all |
| asus | rt-ac3200_firmware | all |
| asus | rt-ac3200 | all |
| asus | rt-ac5300_firmware | all |
| asus | rt-ac5300 | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
3.613%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2018-04-04T00:00:00 |
| Published | 2018-04-04T19:00:00 |
| Patch Date | 2018-04-04 |
| Last Updated | 2024-08-05T07:17:52 |
Community Chatter & Buzz