CVE-2018-20336

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parsereqqueries function in wanduck.c via a long string over UDP, which may lead to an information leak...

CVE-2018-20336

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parsereqqueries function in wanduck.c via a long string over UDP, which may lead to an information leak...

Stack overflow

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parsereqqueries function in wanduck.c via a long string over UDP, which may lead to an information leak...

CVE-2018-20336

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parsereqqueries function in wanduck.c via a long string over UDP, which may lead to an information leak...

CVE-2018-20336

CVE-2018-20336 affects ASUSWRT 3.0.0.4.384.20308. A stack-based buffer overflow in the parse_req_queries function of wanduck.c can be triggered by a long UDP string, leading to an information leak. Multiple connected records (Red Hat, CNVD/CVE mirrors, NVD) corroborate the issue and version. No e...

Asuswrt-Merlin Merlin.PHP component command execution vulnerability (CNVD-2018-21490)

Asuswrt-Merlin is a firmware from ASUS that runs in its routers.Merlin.PHP is one of the web-based admin panel components. A security vulnerability exists in the Asuswrt-Merlin Merlin.PHP component version 0.6.6. A remote attacker could exploit the vulnerability to execute arbitrary commands...

Asuswrt-Merlin Merlin.PHP Component Command Execution Vulnerability

Asuswrt-Merlin is a firmware from ASUS that runs in its routers.Merlin.PHP is one of the web-based admin panel components. A command execution vulnerability exists in version 0.6.6 of the Asuswrt-Merlin Merlin.PHP component that can be exploited by a remote attacker to execute arbitrary commands...

Remote code execution

DISPUTED An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows...

CVE-2018-18319

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...

CVE-2018-18320

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote co...

Remote code execution

DISPUTED An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is...

CVE-2018-18320

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote co...

CVE-2018-18319

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...

CVE-2018-18319

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...

CVE-2018-18320

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote co...

CVE-2018-18320

This CVE affects the Merlin.PHP component (version 0.6.6) used in Asuswrt-Merlin devices. The vulnerability is a remote code execution due to a popen call in exec.php, allowing an attacker to execute arbitrary commands. The vendor notes Merlin.PHP is intended for trusted intranet use, which impli...

CVE-2018-18319

Summary: CVE-2018-18319 affects Merlin.PHP 0.6.6 on Asuswrt-Merlin devices, where an eval in api.php allows a remote attacker to execute arbitrary commands (example: /6/api.php?function=command&class=remote&Cc='ls'). The vendor notes Merlin.PHP is intended for trusted intranet networks, which fac...

PT-2018-14404 · Asuswrt Merlin · Merlin.Php

Name of the Vulnerable Software and Affected Versions: Merlin.PHP version 0.6.6 Description: An issue was discovered in the Merlin.PHP component for Asuswrt-Merlin devices, allowing an attacker to execute arbitrary commands due to a popen call in exec.php. The vendor notes that Merlin.PHP is...

PT-2018-14403 · Asuswrt Merlin · Merlin.Php

Name of the Vulnerable Software and Affected Versions: Merlin.PHP version 0.6.6 Description: An issue was discovered in the Merlin.PHP component for Asuswrt-Merlin devices, allowing an attacker to execute arbitrary commands. This is due to an eval call in api.php, as demonstrated by the...

ASUSWRT AC53 Session Stealing Remote Command Execution (CVE-2017-6549)

A remote command execution vulnerability exists in Asuswrt. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...