CVE-2018-18319

🗓️ 15 Oct 2018 06:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 47 Views🌐 WEB

An issue in Merlin.PHP component 0.6.6 allows arbitrary command execution

Reporter	Title	Published	Views	Family All 7
CNVD	Asuswrt-Merlin Merlin.PHP component command execution vulnerability (CNVD-2018-21490)	18 Oct 201800:00	–	cnvd
Cvelist	CVE-2018-18319	15 Oct 201806:00	–	cvelist
NVD	CVE-2018-18319	15 Oct 201806:29	–	nvd
OSV	CVE-2018-18319	15 Oct 201806:29	–	osv
Prion	Remote code execution	15 Oct 201806:29	–	prion
Positive Technologies	PT-2018-14403 · Asuswrt Merlin · Merlin.Php	15 Oct 201800:00	–	ptsecurity
RedhatCVE	CVE-2018-18319	9 Jan 202612:10	–	redhatcve

NVD

Node

asuswrt-merlin_project rt-ac5300_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac5300Match-

Node

asuswrt-merlin_project rt_ac1900p_firmwareRange≤380.70

AND

asuswrt-merlin_project rt_ac1900p_Match-

Node

asuswrt-merlin_project rt-ac68u_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac68uMatch-

Node

asuswrt-merlin_project rt-ac68p_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac68pMatch-

Node

asuswrt-merlin_project rt-ac88u_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac88uMatch-

Node

asuswrt-merlin_project rt-ac66u_b1_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac66u_b1Match-

Node

asuswrt-merlin_project rt-ac56u_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac56uMatch-

Node

asuswrt-merlin_project rt-ac3200_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac3200Match-

Node

asuswrt-merlin_project rt-ac68uf_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac68ufMatch-

Node

asuswrt-merlin_project rt-ac87_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac87Match-

Node

asuswrt-merlin_project rt-ac3100_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac3100Match-

Node

asuswrt-merlin_project rt-ac1900_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac1900Match-

Node

asuswrt-merlin_project rt-ac86u_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac86uMatch-

Node

asuswrt-merlin_project rt-ac2900_firmwareRange≤380.70

AND

asuswrt-merlin_project rt-ac2900Match-

Source	Link
blog	www.blog.51cto.com/010bjsoft/2298902
github	www.github.com/qoli/Merlin.PHP/issues/27

Parameter	Position	Path	Description	CWE
function	query param	6/api.php	Remote code execution via eval in api.php (Merlin.PHP 0.6.6) demonstrated by function=command&class=remote&Cc='ls'	CWE-94
class	query param	6/api.php	Remote code execution via eval in api.php (Merlin.PHP 0.6.6) demonstrated by function=command&class=remote&Cc='ls'	CWE-94
Cc	query param	6/api.php	Remote code execution via eval in api.php (Merlin.PHP 0.6.6) demonstrated by function=command&class=remote&Cc='ls'	CWE-94

17 Jun 2026 01:46Current

9.9High risk

Vulners AI Score9.9

CVSS 27.5

CVSS 39.8

EPSS0.05434

cve-2018-18319 merlin.php asuswrt-merlin security vulnerability remote code execution nvd api security