cbcvebase.
CVE-2018-9285
published 2018-04-04

CVE-2018-9285: Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007…

PriorityP279critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.61%
88.2th percentile
Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices before 3.0.0.4.382.39935; RT-AC87U and RT-AC3200 devices before 3.0.0.4.382.50010; and RT-AC5300 devices before 3.0.0.4.384.20287 allows OS command injection via the pingCNT and destIP fields of the SystemCmd variable.

Affected

11 ranges
VendorProductVersion rangeFixed in
asusrt-ac1900_firmware< 3.0.0.4.384.100073.0.0.4.384.10007
asusrt-ac2900_firmware< 3.0.0.4.384.100073.0.0.4.384.10007
asusrt-ac3100_firmware< 3.0.0.4.384.100073.0.0.4.384.10007
asusrt-ac3200_firmware< 3.0.0.4.382.500103.0.0.4.382.50010
asusrt-ac5300_firmware< 3.0.0.4.384.202873.0.0.4.384.20287
asusrt-ac66u_firmware< 3.0.0.4.384.100073.0.0.4.384.10007
asusrt-ac68u_firmware< 3.0.0.4.384.100073.0.0.4.384.10007
asusrt-ac86u_firmware< 3.0.0.4.384.100073.0.0.4.384.10007
asusrt-ac87u_firmware< 3.0.0.4.382.500103.0.0.4.382.50010
asusrt-ac88u_firmware< 3.0.0.4.384.100073.0.0.4.384.10007
asusrt-n18u_firmware< 3.0.0.4.382.399353.0.0.4.382.39935

Detection & IOCsextracted from sources · hover to see the quote

path/apply.cgi↗
path/Main_Analysis_Content.asp↗
path/cmdRet_check.htm↗
otherSystemCmd (parameter with %0a-encoded newline injection)↗
otherIPS signature: Asus.Apply.CGI.POST.Buffer.Overflow↗
  • →Monitor HTTP requests to /apply.cgi containing the 'SystemCmd' parameter with percent-encoded newline characters (%0a) used to inject OS commands, bypassing server-side filtering. ↗
  • →Alert on HTTP Cookie header being exfiltrated or replayed in requests to /apply.cgi — exploitation requires a valid authentication token passed in the HTTP Cookie header. ↗
  • →Look for outbound wget requests from ASUS router IPs to attacker-controlled hosts, followed by chmod and execution of a dropped ELF binary in /tmp — indicative of post-exploitation payload staging. ↗
  • →Inspect the 'pingCNT' and 'destIP' input fields in requests to /apply.cgi for injected shell metacharacters — these are the source fields used to construct the malicious SystemCmd variable. ↗
  • ·Exploitation requires the attacker to be authenticated — a valid session/auth token must be obtained first (e.g., via credential theft or CSRF). Unauthenticated scanning will not trigger the vulnerability. ↗
  • ·The Metasploit module targets ASUS TM-AC1900 specifically and exploits a bypass of the original CVE-2018-9285 patch via %0a encoding; other ASUS models may behave differently. ↗
  • ·The vulnerability is considered a regression — it was inadvertently reintroduced in a prior firmware version, so devices on intermediate firmware versions between patched releases may also be vulnerable. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.