Lucene search

MitreCVE-2018-20334

HistoryMar 20, 2020 - 1:15 a.m.

CVE-2018-20334

2020-03-2001:15:22

CWE-78

mitre

web.nvd.nist.gov

asuswrt

command injection

shell metacharacters

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.013

Percentile

86.2%

JSON

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacters in the fb_email parameter. By using this issue, an attacker can control the router and get shell.

Affected configurations

Nvd

Node

asusasuswrtMatch3.0.0.4.384.20308

AND

asusgt-ac2900Match-

asusgt-ac5300Match-

asusgt-ax11000Match-

asusrt-ac1200Match-

asusrt-ac1200_v2Match-

asusrt-ac1200gMatch-

asusrt-ac1200geMatch-

asusrt-ac1750Match-

asusrt-ac1750_b1Match-

asusrt-ac1900pMatch-

asusrt-ac3100Match-

asusrt-ac3200Match-

asusrt-ac51uMatch-

asusrt-ac5300Match-

asusrt-ac55uMatch-

asusrt-ac56rMatch-

asusrt-ac56sMatch-

asusrt-ac56uMatch-

asusrt-ac66rMatch-

asusrt-ac66uMatch-

asusrt-ac66u-b1Match-

asusrt-ac66u_b1Match-

asusrt-ac68pMatch-

asusrt-ac68uMatch-

asusrt-ac86uMatch-

asusrt-ac87uMatch-

asusrt-ac88uMatch-

asusrt-acrh12Match-

asusrt-acrh13Match-

asusrt-ax3000Match-

asusrt-ax56uMatch-

asusrt-ax58uMatch-

asusrt-ax88uMatch-

asusrt-ax92uMatch-

asusrt-g32Match-

asusrt-n10\+d1Match-

asusrt-n10eMatch-

asusrt-n14uMatch-

asusrt-n16Match-

asusrt-n19Match-

asusrt-n56rMatch-

asusrt-n56uMatch-

asusrt-n600Match-

asusrt-n65uMatch-

asusrt-n66rMatch-

asusrt-n66uMatch-

VendorProductVersionCPE
asusasuswrt3.0.0.4.384.20308cpe:2.3:o:asus:asuswrt:3.0.0.4.384.20308:*:*:*:*:*:*:*
asusgt-ac2900-cpe:2.3:h:asus:gt-ac2900:-:*:*:*:*:*:*:*
asusgt-ac5300-cpe:2.3:h:asus:gt-ac5300:-:*:*:*:*:*:*:*
asusgt-ax11000-cpe:2.3:h:asus:gt-ax11000:-:*:*:*:*:*:*:*
asusrt-ac1200-cpe:2.3:h:asus:rt-ac1200:-:*:*:*:*:*:*:*
asusrt-ac1200_v2-cpe:2.3:h:asus:rt-ac1200_v2:-:*:*:*:*:*:*:*
asusrt-ac1200g-cpe:2.3:h:asus:rt-ac1200g:-:*:*:*:*:*:*:*
asusrt-ac1200ge-cpe:2.3:h:asus:rt-ac1200ge:-:*:*:*:*:*:*:*
asusrt-ac1750-cpe:2.3:h:asus:rt-ac1750:-:*:*:*:*:*:*:*
asusrt-ac1750_b1-cpe:2.3:h:asus:rt-ac1750_b1:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
asus	asuswrt	3.0.0.4.384.20308	cpe:2.3:o:asus:asuswrt:3.0.0.4.384.20308:::::::*
asus	gt-ac2900	-	cpe:2.3:h:asus:gt-ac2900:-:::::::*
asus	gt-ac5300	-	cpe:2.3:h:asus:gt-ac5300:-:::::::*
asus	gt-ax11000	-	cpe:2.3:h:asus:gt-ax11000:-:::::::*
asus	rt-ac1200	-	cpe:2.3:h:asus:rt-ac1200:-:::::::*
asus	rt-ac1200_v2	-	cpe:2.3:h:asus:rt-ac1200_v2:-:::::::*
asus	rt-ac1200g	-	cpe:2.3:h:asus:rt-ac1200g:-:::::::*
asus	rt-ac1200ge	-	cpe:2.3:h:asus:rt-ac1200ge:-:::::::*
asus	rt-ac1750	-	cpe:2.3:h:asus:rt-ac1750:-:::::::*
asus	rt-ac1750_b1	-	cpe:2.3:h:asus:rt-ac1750_b1:-:::::::*

Rows per page:

1-10 of 471

References

starlabs.sg/advisories/18-20334/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.013

Percentile

86.2%

JSON

Related for CVE-2018-20334