132 matches found
CVE-2018-8879
Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...
CVE-2018-8877
Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the newlanip variable on the errorpage.htm page...
CVE-2018-8878
Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network devices' hostnames and MAC addresses by reading the customid variable on the blocking.asp...
Ukrainian Military Targeted in Phishing Campaign Leveraging Drone Manuals
Ukrainian military entities are the target of a phishing campaign that leverages drone manuals as lures to deliver a Go-based open-source post-exploitation toolkit called Merlin. "Since drones or Unmanned Aerial Vehicles UAVs have been an integral tool used by the Ukrainian military, malware-lace...
merlinfoundation.org Cross Site Scripting vulnerability OBB-3699096
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
The vulnerability of the httpd function’s unescape function in the cgi.c file of the Asuswrt-Merlin New Gen microprogramming system allows a hacker to cause memory corruption.
The vulnerability of the unescape function in httpd’s cgi.c file of the Asuswrt-Merlin New Gen software relates to the escape operation going beyond buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause memory corruption by sending a specially crafted...
merlin-notaire.com Cross Site Scripting vulnerability OBB-3244880
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-26376
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability...
Memory corruption
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability...
CVE-2022-26376
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability...
CVE-2022-26376
CVE-2022-26376 affects Asuswrt and Asuswrt-Merlin New Gen. The vulnerability is a memory corruption in the httpd unescape function triggered by a crafted HTTP request; it arises due to missing bounds checking after a '%' character, potentially causing memory corruption or crashes via network inpu...
ASUS Asuswrt-Merlin 缓冲区错误漏洞
ASUS Asuswrt-Merlin is a firmware from Asus Taiwan, China that runs in its routers. A buffer error vulnerability exists in ASUS Asuswrt-Merlin version 3.0.0.4.38648706 and Asuswrt-Merlin New Gen 386.1-beta1, which stems from a specially crafted HTTP request that could result in memory corruption...
Asuswrt and Asuswrt-Merlin New Gen httpd unescape memory corruption vulnerability
Talos Vulnerability Report TALOS-2022-1511 Asuswrt and Asuswrt-Merlin New Gen httpd unescape memory corruption vulnerability July 27, 2022 CVE Number CVE-2022-26376 SUMMARY A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and...
merlin-zwo.de Cross Site Scripting vulnerability OBB-2730915
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
merlin-it.de Cross Site Scripting vulnerability OBB-2701232
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Malicious code in merlin-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50d7dcf4fcdd9219988153659111f9f161edaceb483c6642ac3ef3c334038c31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4563 Malicious code in merlin-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50d7dcf4fcdd9219988153659111f9f161edaceb483c6642ac3ef3c334038c31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in merlin-products-fetch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc2949d7ccace2a49fa195114fa2ec70249c0da126015d8633f6780145cf0e7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in merlin-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acbec8231459b734564c16533b3248cc88adefb4f32cf4a06fc6d3e42e8dfb45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4561 Malicious code in merlin-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acbec8231459b734564c16533b3248cc88adefb4f32cf4a06fc6d3e42e8dfb45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...