CVE-2018-6000
82Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 85%
da publicação à arma0 dias
Publicada no NVD22 de jan.
1ª PoC22 de jan.
metasploit22 de jan.
VulnCheck+2970d
probabilidade de exploração
85%top 1% das CVEs
exploração observada
simVulnCheck
4 exploit(s) público(s)
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.
Produtos afetados
n/a · n/aPoCs públicas encontradas — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44176exploitdbwww.exploit-db.com/exploits/43881não verificadocve_referencewww.exploit-db.com/exploits/43881/não verificadocve_referencewww.exploit-db.com/exploits/44176/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://blogs.securiteam.com/index.php/archives/3589https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txthttps://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rbhttps://www.exploit-db.com/exploits/43881/https://www.exploit-db.com/exploits/44176/