CVE-2018-20334: OS Command Injection
First published: Fri Mar 20 2020(Updated: )
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacters in the fb_email parameter. By using this issue, an attacker can control the router and get shell.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Asus asuswrt | =3.0.0.4.384.20308 | |
| ASUS GT-AC2900 | ||
| ASUS GT-AC5300 | ||
| Asus Gt-ax11000 | ||
| Asus Rt-ac1200 | ||
| Asus Rt-ac1200 V2 | ||
| Asus Rt-ac1200g | ||
| Asus Rt-ac1200ge | ||
| Asus Rt-ac1750 | ||
| Asus Rt-ac1750 B1 | ||
| ASUS RT-AC1900P | ||
| Asus Rt-ac3100 | ||
| ASUS RT-AC3200 | ||
| ASUS RT-AC51U | ||
| Asus Rt-ac5300 | ||
| Asus Rt-ac55u | ||
| Asus Rt-ac56r | ||
| Asus Rt-ac56s | ||
| Asus Rt-ac56u | ||
| Asus Rt-ac66r | ||
| ASUS RT-AC66U | ||
| Asus Rt-ac66u-b1 | ||
| ASUS RT-AC66U B1 | ||
| Asus Rt-ac68p | ||
| ASUS RT-AC68U | ||
| ASUS RT-AC86U | ||
| ASUS RT-AC87U | ||
| Asus Rt-ac88u | ||
| Asus Rt-acrh12 | ||
| Asus Rt-acrh13 | ||
| ASUS RT-AX3000 | ||
| ASUS RT-AX56U | ||
| Asus Rt-ax58u | ||
| ASUS RT-AX88U | ||
| ASUS RT-AX92U | ||
| ASUS RT-G32 | ||
| Asus Rt-n10\+d1 | ||
| ASUS RT-N10E | ||
| Asus Rt-n14u | ||
| Asus Rt-n16 | ||
| Asus Rt-n19 | ||
| Asus Rt-n56r | ||
| ASUS RT-N56U | ||
| Asus Rt-n600 | ||
| Asus Rt-n65u | ||
| Asus Rt-n66r | ||
| Asus Rt-n66u |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-20334?
CVE-2018-20334 is an issue discovered in ASUSWRT 3.0.0.4.384.20308 that allows command injection via shell metacharacters.
How severe is CVE-2018-20334?
CVE-2018-20334 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2018-20334?
The ASUSWRT version 3.0.0.4.384.20308 is affected by CVE-2018-20334.
How can an attacker exploit CVE-2018-20334?
An attacker can exploit CVE-2018-20334 by using shell metacharacters in the fb_email parameter to execute arbitrary commands and gain control of the router and obtain shell access.
Where can I find more information about CVE-2018-20334?
You can find more information about CVE-2018-20334 at the following link: https://starlabs.sg/advisories/18-20334/
- agent/type
- agent/weakness
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/references
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/asus
- canonical/asus asuswrt
- version/asus asuswrt/3.0.0.4.384.20308
- canonical/asus gt-ac2900
- canonical/asus gt-ac5300
- canonical/asus gt-ax11000
- canonical/asus rt-ac1200
- canonical/asus rt-ac1200 v2
- canonical/asus rt-ac1200g
- canonical/asus rt-ac1200ge
- canonical/asus rt-ac1750
- canonical/asus rt-ac1750 b1
- canonical/asus rt-ac1900p
- canonical/asus rt-ac3100
- canonical/asus rt-ac3200
- canonical/asus rt-ac51u
- canonical/asus rt-ac5300
- canonical/asus rt-ac55u
- canonical/asus rt-ac56r
- canonical/asus rt-ac56s
- canonical/asus rt-ac56u
- canonical/asus rt-ac66r
- canonical/asus rt-ac66u
- canonical/asus rt-ac66u-b1
- canonical/asus rt-ac66u b1
- canonical/asus rt-ac68p
- canonical/asus rt-ac68u
- canonical/asus rt-ac86u
- canonical/asus rt-ac87u
- canonical/asus rt-ac88u
- canonical/asus rt-acrh12
- canonical/asus rt-acrh13
- canonical/asus rt-ax3000
- canonical/asus rt-ax56u
- canonical/asus rt-ax58u
- canonical/asus rt-ax88u
- canonical/asus rt-ax92u
- canonical/asus rt-g32
- canonical/asus rt-n10\+d1
- canonical/asus rt-n10e
- canonical/asus rt-n14u
- canonical/asus rt-n16
- canonical/asus rt-n19
- canonical/asus rt-n56r
- canonical/asus rt-n56u
- canonical/asus rt-n600
- canonical/asus rt-n65u
- canonical/asus rt-n66r
- canonical/asus rt-n66u