CVE-2017-6548

published 2017-03-09

CVE-2017-6548: Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U…

Priority P2 73 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before 3.0.0.4.380.7378; RT-AC68W routers with firmware before 3.0.0.4.380.7266; and RT-N600, RT-N12+ B1, RT-N11P B1, RT-N12VP B1, RT-N12E C1, RT-N300 B1, and RT-N12+ Pro routers with firmware before 3.0.0.4.380.9488; and Asuswrt-Merlin firmware before 380.65_2 allow remote attackers to execute arbitrary code on the router via a long host or port in crafted multicast messages.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
asus	rt-ac53_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 1900↗

ip 239.255.255.250↗

port 1008↗

process networkmap↗

bytes↗

HTTP/1.1 200 OK\r\nLocation:HTTP:// + CCCC*11 + \xfc\x8c\x40/

bytes↗

HTTP/1.1 200 OK\r\nLocation:HTTP:// + AAAA*11 + \x04\xd5\x41/

• → Monitor for crafted SSDP multicast responses (UDP src port 1008 from router IP) containing an oversized Location header with repeated byte patterns (e.g., 'AAAA'*11 or 'CCCC'*11) sent to 239.255.255.250:1900 — this is the buffer overflow trigger in networkmap's process_device_response(). ↗
• → Detect SSDP M-SEARCH multicast traffic originating from the router (239.255.255.250:1900) followed by a response containing an abnormally long Location: HTTP:// header value — the host or port field exceeds the fixed buffer sizes (host[16], port[6]). ↗
• → Alert on TCP connections to router port 0x1337 (4919) post-exploitation — the exploit attempts to open a reverse telnet shell on this non-standard port. ↗
• → Detect a rogue HTTP server on attacker-controlled host listening on port 1337 serving shellcode, contacted by the router after heap spray — indicated by the router initiating an outbound HTTP GET to an internal LAN IP on port 1337. ↗
• → The exploit sends multiple crafted SSDP responses in sequence (clean → heap → heap2 → pwn states) to the same sender; detect repeated SSDP responses from the same LAN host to the router's discovery port 1008 as a heap-spray indicator. ↗

• · Vulnerable firmware versions: affected devices require firmware before 3.0.0.4.380.7378 (most models), before 3.0.0.4.380.7266 (RT-AC68W), or before 3.0.0.4.380.9488 (RT-N600 and related); Asuswrt-Merlin before 380.65_2. ↗
• · The exploit PoC was written for RT-AC53 firmware 3.0.0.4.380.6038; ROP gadget offsets (\xfc\x8c\x40 and \x04\xd5\x41) are firmware-specific and will differ across device models and firmware versions. ↗
• · Attack is LAN-side only — the exploit requires the attacker to be on the same local network segment as the router, as it relies on receiving the router's multicast SSDP M-SEARCH from 239.255.255.250:1900. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119