CVE-2018-20334

  1. Reconshell
  2. Vulnerabilities (CVE)
  3. CVE-2018-20334
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacters in the fb_email parameter. By using this issue, an attacker can control the router and get shell.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://starlabs.sg/advisories/18-20334/ Exploit Third Party Advisory
Advertisement

NeevaHost hosting service
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:asus:asuswrt:3.0.0.4.384.20308:*:*:*:*:*:*:*
OR cpe:2.3:h:asus:gt-ac2900:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:gt-ac5300:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:gt-ax11000:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac1200:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac1200_v2:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac1200g:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac1200ge:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac1750:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac1750_b1:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac1900p:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac3100:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac66u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac56s:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac87u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac68u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac88u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac3200:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac5300:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac51u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac55u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-acrh13:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac56r:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac66r:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac66u-b1:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac68p:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac56u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ac66u_b1:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-acrh12:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax3000:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax56u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax58u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax88u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n65u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n56u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n16:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n14u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n10e:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-g32:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n66u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n600:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n10\+d1:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n56r:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n66r:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax92u:-:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-n19:-:*:*:*:*:*:*:*
Information

Published : 2020-03-19 18:15

Updated : 2020-03-23 14:59

NVD link : CVE-2018-20334

Mitre link : CVE-2018-20334

JSON object : View

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Advertisement

dedicated server usa
Products Affected

asus

  • rt-ac55u
  • rt-n14u
  • rt-n56r
  • rt-ax92u
  • rt-ac87u
  • rt-n65u
  • rt-ac3100
  • rt-ac1750
  • rt-ac1200_v2
  • rt-n16
  • rt-ac51u
  • rt-ac56r
  • rt-ac56s
  • rt-acrh13
  • rt-ac1750_b1
  • rt-n66u
  • rt-ac86u
  • rt-ac3200
  • rt-n10e
  • rt-ac1200ge
  • rt-g32
  • rt-ac68p
  • gt-ax11000
  • rt-ac56u
  • rt-n56u
  • rt-ax58u
  • rt-ac1200
  • rt-ax88u
  • rt-ac1900p
  • rt-ac66r
  • rt-ac66u-b1
  • rt-n66r
  • rt-ac5300
  • rt-n19
  • rt-n600
  • rt-ac66u
  • rt-ac88u
  • rt-acrh12
  • rt-ax3000
  • rt-ax56u
  • gt-ac5300
  • rt-ac1200g
  • asuswrt
  • rt-ac68u
  • gt-ac2900
  • rt-ac66u_b1
  • rt-n10\+d1