CVE-2018-8877

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the newlanip variable on the errorpage.htm page...

CVE-2018-8878

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network devices' hostnames and MAC addresses by reading the customid variable on the blocking.asp...

Information disclosure

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the newlanip variable on the errorpage.htm page...

CVE-2018-8877

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the newlanip variable on the errorpage.htm page...

Information disclosure

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network devices' hostnames and MAC addresses by reading the customid variable on the blocking.asp...

CVE-2018-8878

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network devices' hostnames and MAC addresses by reading the customid variable on the blocking.asp...

CVE-2018-8878

CVE-2018-8878 affects Asuswrt-Merlin firmware on ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470. The vulnerability allows remote attackers to read the custom_id variable on the blocking.asp page, enabling information disclosure of internal network hostnames and MAC addre...

CVE-2018-8877

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the newlanip variable on the errorpage.htm page...

CVE-2018-8877

CVE-2018-8877 affects Asuswrt-Merlin firmware on ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470. The issue is an information disclosure: remote attackers can read the new_lan_ip variable on error_page.htm to learn internal network IP address ranges. Root cause is reading...

CVE-2018-8879

Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...

CVE-2018-8879

Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...

CVE-2018-8879

Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...

CVE-2018-8879

CVE-2018-8879 affects Asuswrt-Merlin firmware on ASUS devices: stack-based buffer overflow in the blocking.asp page, triggered by long input via GET/POST. Vulnerable parameters are flag, mac, and cat_id. Impact stated: remote code execution with arbitrary code, for devices running ASUS firmware b...

ASUS Asuswrt-Merlin Buffer Overflow Vulnerability

ASUS Asuswrt-Merlin is a firmware from Asus ASUS of Taiwan, China that runs in its routers. A buffer overflow vulnerability exists in the 'parsereqqueries' function of the wanduck.c file in ASUS Asuswrt-Merlin version 3.0.0.4.384.20308. The vulnerability stems from a network system or product...

Asuswrt-Merlin Merlin.PHP component command execution vulnerability (CNVD-2018-21490)

Asuswrt-Merlin is a firmware from ASUS that runs in its routers.Merlin.PHP is one of the web-based admin panel components. A security vulnerability exists in the Asuswrt-Merlin Merlin.PHP component version 0.6.6. A remote attacker could exploit the vulnerability to execute arbitrary commands...

Asuswrt-Merlin Merlin.PHP Component Command Execution Vulnerability

Asuswrt-Merlin is a firmware from ASUS that runs in its routers.Merlin.PHP is one of the web-based admin panel components. A command execution vulnerability exists in version 0.6.6 of the Asuswrt-Merlin Merlin.PHP component that can be exploited by a remote attacker to execute arbitrary commands...

CVE-2018-18319

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...

Remote code execution

DISPUTED An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows...

CVE-2018-18320

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote co...

Remote code execution

DISPUTED An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is...