CVSS: 10.0EPSS: 25%CPEs: 1EXPL: 6CVE-2018-5999 – AsusWRT LAN Unauthenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-5999
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails. Se ha descubierto un problema en versiones anteriores a la 3.0.0.4.384_10007 de AsusWRT. En la función handle_request en router/httpd/httpd.c, el procesamiento de peticiones POST continúa incluso aunque falle la autenticación. AsusWRT Router versions prior to 3.0.0.4.380.7743 suffer from an unauthenticated LAN remote code execution vulnerability. • https://www.exploit-db.com/exploits/44176 https://www.exploit-db.com/exploits/43881 https://blogs.securiteam.com/index.php/archives/3589 https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb https://raw.githubusercontent.com/pedrib/PoC/master/advisories/asuswrt-lan-rce.txt https://seclists.org/fulldisclosure/2018/Jan/78 https://raw.githubusercontent.com/rapid7/metasploit-framework/mas •
CVSS: 10.0EPSS: 9%CPEs: 1EXPL: 6CVE-2018-6000 – AsusWRT LAN Unauthenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-6000
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999. Se ha descubierto un problema en versiones anteriores a la 3.0.0.4.384_10007 de AsusWRT. La función do_vpnupload_post en router/httpd/web.c en vpnupload.cgi proporciona funcionalidades para establecer valores de configuración NVRAM, lo que permite que atacantes establezcan la contraseña de administrador e inicien un demonio SSH (o permitan el modo de comandos infosvr) y, en consecuencia, obtengan acceso remoto administrativo mediante una petición manipulada. • https://www.exploit-db.com/exploits/44176 https://www.exploit-db.com/exploits/43881 https://blogs.securiteam.com/index.php/archives/3589 https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb https://raw.githubusercontent.com/pedrib/PoC/master/advisories/asuswrt-lan-rce.txt https://seclists.org/fulldisclosure/2018/Jan/78 https://raw.githubusercontent.com/rapid7/metasploit-framework/mas • CWE-862: Missing Authorization •