ASUSWRT vpnupload.cgi authentication bypass
Added: 02/28/2018CVE: CVE-2018-5999
Background
ASUSWRT is the firmware used in many ASUS devices.Problem
The combination of two separate vulnerabilities in ASUSWRT allows remote attackers to execute arbitrary commands. The first vulnerability allows an unauthenticated user to make certain POST requests. The second allows NVRAM settings to be changed using a POST request to vpnupload.cgi.Resolution
Upgrade to ASUSWRT version 3.0.0.4.384_10007 or higher.References
http://seclists.org/fulldisclosure/2018/Jan/78Platforms
LinuxBack to exploit index