Vulnerabilities > CVE-2018-6000 - Missing Authorization vulnerability in Asus Asuswrt 3.0.0.4.378/3.0.0.4.380.7743/3.0.0.4.384.20308

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
asus
CWE-862
critical
exploit available
metasploit
NVD
Published: 2018-01-22
Updated: 2024-11-21

Summary

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.

Vulnerable Configurations

Part Description Count
OS
Asus
4

Common Weakness Enumeration (CWE)

Exploit-Db

  • descriptionAsusWRT Router < 3.0.0.4.380.7743 - Unauthenticated LAN Remote Code Execution. CVE-2018-5999,CVE-2018-6000. Remote exploit for Hardware platform
    fileexploits/hardware/remote/43881.txt
    idEDB-ID:43881
    last seen2018-01-25
    modified2018-01-22
    platformhardware
    port
    published2018-01-22
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/43881/
    titleAsusWRT Router < 3.0.0.4.380.7743 - Unauthenticated LAN Remote Code Execution
    typeremote
  • descriptionAsusWRT LAN - Unauthenticated Remote Code Execution (Metasploit). CVE-2018-5999,CVE-2018-6000. Remote exploit for Hardware platform. Tags: Metasploit Framewo...
    fileexploits/hardware/remote/44176.rb
    idEDB-ID:44176
    last seen2018-02-26
    modified2018-02-26
    platformhardware
    port9999
    published2018-02-26
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/44176/
    titleAsusWRT LAN - Unauthenticated Remote Code Execution (Metasploit)
    typeremote

Metasploit

descriptionThe HTTP server in AsusWRT has a flaw where it allows an unauthenticated client to perform a POST in certain cases. This can be combined with another vulnerability in the VPN configuration upload routine that sets NVRAM configuration variables directly from the POST request to enable a special command mode. This command mode can then be abused by sending a UDP packet to infosvr, which is running on port UDP 9999 to directly execute commands as root. This exploit leverages that to start telnetd in a random port, and then connects to it. It has been tested with the RT-AC68U running AsusWRT Version 3.0.0.4.380.7743.
idMSF:EXPLOIT/LINUX/HTTP/ASUSWRT_LAN_RCE
last seen2020-06-10
modified2019-08-15
published2018-01-22
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/asuswrt_lan_rce.rb
titleAsusWRT LAN Unauthenticated Remote Code Execution

Packetstorm

References