CVE-2018-14713 — Use of Externally-Controlled Format String in Rt-ac3200 Firmware

CWE-134 — Use of Externally-Controlled Format String4 documents4 sources

Severity

8.1HIGHNVD

EPSS

1.1%

top 21.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Asus Rt-ac3200 Firmware

Timeline

PublishedMay 13

Latest updateSep 25

Description

Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers via the "hook" URL parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages1 packages

▶NVDasus/rt-ac3200_firmware3.0.0.4.382.50010

🔴Vulnerability Details

GHSA

GHSA-hwpj-2v36-69r4: Format string vulnerability in appGet↗2022-05-24

▶

CVEList

CVE-2018-14713: Format string vulnerability in appGet↗2019-05-13

▶

🔍Detection Rules

Suricata

ET WEB_SPECIFIC_APPS ASUS RT-AC3200 Uncontrolled Format String via nvram_match Hook Family in appGet.cgi (CVE-2018-14713)↗2025-09-25

▶