Critical severity · published Jan 22, 2018
CVE-2018-6000
An issue was discovered in AsusWRT before 3.0.0.4.384_10007
9.8
CVSS
85.2%
EPSS
No
On KEV
Description
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)85.2% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asuswrt · Asus
before 3.0.0.4.384_10007 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6000
Exploit
https://blogs.securiteam.com/index.php/archives/3589
Exploit
https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt
Exploit
https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb
Exploit
https://www.exploit-db.com/exploits/43881/
www.exploit-db.com
https://www.exploit-db.com/exploits/44176/
More from Asuswrt
9.8
CVE-2022-26376
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7
9.8
CVE-2018-20334
An issue was discovered in ASUSWRT 3.0.0.4.384.20308
9.8
CVE-2018-5999
An issue was discovered in AsusWRT before 3.0.0.4.384_10007
9.6
CVE-2017-15655
Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X
8.8
CVE-2017-15656
Password are stored in plaintext in nvram in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt