CVE-2018-5999
published 2018-01-22CVE-2018-5999: An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even…
PriorityP189critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
87.15%
99.7th percentile
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asus | asuswrt | < 3.0.0.4.384_10007 | 3.0.0.4.384_10007 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0x0C 0x15 0x33 0x00 (NET_SERVICE_ID_IBOX_INFO, NET_PACKET_TYPE_CMD, NET_CMD_ID_MANU_CMD) — UDP infosvr PKT_SYSCMD header
- →Detect unauthenticated HTTP POST requests to /vpnupload.cgi on AsusWRT devices; legitimate access requires authentication. ↗
- →Alert on UDP packets to port 9999 (infosvr) containing the byte sequence 0x0C 0x15 0x33 0x00 at the start of the payload, indicating a PKT_SYSCMD (NET_CMD_ID_MANU_CMD) command execution attempt. ↗
- →Monitor for spawning of telnetd processes on AsusWRT routers, especially with the arguments '-l /bin/sh', which indicates post-exploitation shell access. ↗
- →Flag multipart/form-data POST requests to /vpnupload.cgi that include the field 'ateCommand_flag' set to '1', which enables the privileged command mode (PKT_SYSCMD). ↗
- →The authentication bypass occurs in handle_request() in router/httpd/httpd.c — POST request handler->input() is called even when auth_result != 0; look for POST requests to the router HTTP server that lack valid session cookies or Authorization headers. ↗
- ·The exploit is LAN-scoped only; the attack vector requires the attacker to be on the same local network as the vulnerable AsusWRT router. ↗
- ·The telnetd backdoor is spawned on a random high port (1024–65535), so port-based blocking alone is insufficient; process-level monitoring for telnetd is needed. ↗
- ·Confirmed affected version is 3.0.0.4.380.7743; all versions before 3.0.0.4.384.10007 are potentially vulnerable. ↗
- ·The infosvr UDP packet is fixed at 512 bytes (info_pdu_size = 512); padding bytes are random, so signature matching should focus on the first 4 header bytes rather than the full packet. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8pph-m89g-pffm: An issue was discovered in AsusWRT before 3
ghsa_unreviewed·2022-05-13
CVE-2018-5999 [CRITICAL] GHSA-8pph-m89g-pffm: An issue was discovered in AsusWRT before 3
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
GHSA
GHSA-92f5-6w73-42pg: An issue was discovered in AsusWRT before 3
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2018-6000 [CRITICAL] CWE-862 GHSA-92f5-6w73-42pg: An issue was discovered in AsusWRT before 3
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.
VulnCheck
ASUS asuswrt Missing Authorization
vulncheck·2018·CVSS 9.8
CVE-2018-6000 [CRITICAL] ASUS asuswrt Missing Authorization
ASUS asuswrt Missing Authorization
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.
Affected: ASUS asuswrt
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis
VulnCheck
ASUS asuswrt Vulnerability
vulncheck·2018·CVSS 9.8
CVE-2018-5999 [CRITICAL] ASUS asuswrt Vulnerability
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
Affected: ASUS asuswrt
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2018-5999&date=2026-05-17
No detection rules found.
Exploit-DB
AsusWRT LAN - Remote Code Execution (Metasploit)
exploitdb·2018-02-26
CVE-2018-6000 AsusWRT LAN - Remote Code Execution (Metasploit)
AsusWRT LAN - Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'AsusWRT LAN Unauthenticated Remote Code Execution',
'Description' => %q{
The HTTP server in AsusWRT has a flaw where it allows an unauthenticated client to
perform a POST in certain cases. This can be combined with another vulnerability in
the VPN configuration upload routine that sets NVRAM configuration variables directly
from the POST request to enable a special command mode.
This command mode can then be abused by sending a UDP packet to infosvr, which is running
on port UDP 9999 to directly execute commands as root.
This exploit leverages that to start telnetd in a random
Exploit-DB
AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution
exploitdb·2018-01-22·CVSS 9.8
CVE-2018-6000 [CRITICAL] AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution
AsusWRT Router > Unauthenticated LAN remote code execution in AsusWRT
>> Discovered by Pedro Ribeiro ([email protected]), Agile Information Security
Disclosure: 22/01/2018 / Last updated: 25/01/2018
>> Background and summary
AsusWRT is the operating system used in mid range and high end Asus routers. It is based on Linux, but with a sleek web UI and a slimmed down profile suitable for running on resource constrained routers.
Thankfully ASUS is a responsible company, and not only they publish the full source code as required by the GPL, but they also give users full root access to their router via SSH. Overall the security of their operating system is pretty good, especially when compared to other router manufacturers.
However due to a number of coding errors, it is possible for an unauth
Metasploit
AsusWRT LAN Unauthenticated Remote Code Execution
metasploit
AsusWRT LAN Unauthenticated Remote Code Execution
AsusWRT LAN Unauthenticated Remote Code Execution
The HTTP server in AsusWRT has a flaw where it allows an unauthenticated client to perform a POST in certain cases. This can be combined with another vulnerability in the VPN configuration upload routine that sets NVRAM configuration variables directly from the POST request to enable a special command mode. This command mode can then be abused by sending a UDP packet to infosvr, which is running on port UDP 9999 to directly execute commands as root. This exploit leverages that to start telnetd in a random port, and then connects to it. It has been tested with the RT-AC68U running AsusWRT Version 3.0.0.4.380.7743.
Hackernews
⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
blogs_hackernews·2026-05-25
CVE-2026-46333 ⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
Monday recap. Same mess, new week.
A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should've patched years ago. Good times.
Phishing crews are getting smarter too - less obvious scam junk, more targeted stuff that actually looks real. Meanwhile, botnets are grabbing anything exposed to the internet like it's free candy. The Internet's still a dumpster fire.
Let’s get into
Greynoiseio
NoiseLetter August 2024
blogs_greynoiseio
NoiseLetter August 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
https://blogs.securiteam.com/index.php/archives/3589https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txthttps://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rbhttps://www.exploit-db.com/exploits/43881/https://www.exploit-db.com/exploits/44176/https://blogs.securiteam.com/index.php/archives/3589https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txthttps://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rbhttps://www.exploit-db.com/exploits/43881/https://www.exploit-db.com/exploits/44176/
2018-01-22
Published
Exploited in the wild