CVE-2018-20334: OS Command Injection
First published: Fri Mar 20 2020(Updated: )
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacters in the fb_email parameter. By using this issue, an attacker can control the router and get shell.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Asus asuswrt | =3.0.0.4.384.20308 | |
| ASUS ROG Rapture GT-AC2900 | ||
| ASUS ROG Rapture GT-AC5300 | ||
| ASUS GT-AX11000 Firmware | ||
| ASUS RT-AC1200G | ||
| ASUS RT-AC1200 v2 | ||
| ASUS RT-AC1200G Firmware | ||
| ASUS RT-AC1200GE | ||
| ASUS RT-AC1750 firmware | ||
| ASUS RT-AC1750 | ||
| ASUS RT-AC1900P Firmware | ||
| ASUS RT-AC3100 | ||
| ASUS RT-AC3200 Firmware | ||
| ASUS RT-AC51U firmware | ||
| ASUS RT-AC5300 firmware | ||
| ASUS RT-AC55U | ||
| ASUS RT-AC56R Firmware | ||
| ASUS RT-AC56S | ||
| ASUS RT-AC56U Firmware | ||
| ASUS rt-ac66r firmware | ||
| ASUS RT-AC66U firmware | ||
| ASUS RT-AC66U B1 | ||
| ASUS RT-AC66U firmware | ||
| ASUS RT-AC68P Firmware | ||
| ASUS RT-AC68R | ||
| ASUS RT-AC86U firmware | ||
| ASUS RT-AC87U | ||
| ASUS RT-AC88U Firmware | ||
| ASUS RT-ACRH12 | ||
| ASUS RT-ACRH13 firmware | ||
| ASUS RT-AX3000 | ||
| ASUS RT-AX56U firmware | ||
| ASUS RT-AX58U Firmware | ||
| ASUS RT-AX88U Firmware | ||
| ASUS RT-AX92U Firmware | ||
| ASUS RT-G32 | ||
| Asus RT-N10+ D1 firmware | ||
| ASUS RT-N10E Firmware | ||
| ASUS RT-N14U firmware | ||
| ASUS RT-N16 firmware | ||
| ASUS RT-N19 Firmware | ||
| ASUS RT-N56R | ||
| ASUS RT-N56U firmware | ||
| ASUS RT-N600 firmware | ||
| ASUS RT-N65U Firmware | ||
| ASUS RT-N66R | ||
| ASUS RT-N66U Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-20334?
CVE-2018-20334 is an issue discovered in ASUSWRT 3.0.0.4.384.20308 that allows command injection via shell metacharacters.
How severe is CVE-2018-20334?
CVE-2018-20334 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2018-20334?
The ASUSWRT version 3.0.0.4.384.20308 is affected by CVE-2018-20334.
How can an attacker exploit CVE-2018-20334?
An attacker can exploit CVE-2018-20334 by using shell metacharacters in the fb_email parameter to execute arbitrary commands and gain control of the router and obtain shell access.
Where can I find more information about CVE-2018-20334?
You can find more information about CVE-2018-20334 at the following link: https://starlabs.sg/advisories/18-20334/
- agent/type
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/last-modified-date
- agent/event
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- vendor/asus
- canonical/asus asuswrt
- version/asus asuswrt/3.0.0.4.384.20308
- canonical/asus rog rapture gt-ac2900
- canonical/asus rog rapture gt-ac5300
- canonical/asus gt-ax11000 firmware
- canonical/asus rt-ac1200g
- canonical/asus rt-ac1200 v2
- canonical/asus rt-ac1200g firmware
- canonical/asus rt-ac1200ge
- canonical/asus rt-ac1750 firmware
- canonical/asus rt-ac1750
- canonical/asus rt-ac1900p firmware
- canonical/asus rt-ac3100
- canonical/asus rt-ac3200 firmware
- canonical/asus rt-ac51u firmware
- canonical/asus rt-ac5300 firmware
- canonical/asus rt-ac55u
- canonical/asus rt-ac56r firmware
- canonical/asus rt-ac56s
- canonical/asus rt-ac56u firmware
- canonical/asus rt-ac66r firmware
- canonical/asus rt-ac66u firmware
- canonical/asus rt-ac66u b1
- canonical/asus rt-ac68p firmware
- canonical/asus rt-ac68r
- canonical/asus rt-ac86u firmware
- canonical/asus rt-ac87u
- canonical/asus rt-ac88u firmware
- canonical/asus rt-acrh12
- canonical/asus rt-acrh13 firmware
- canonical/asus rt-ax3000
- canonical/asus rt-ax56u firmware
- canonical/asus rt-ax58u firmware
- canonical/asus rt-ax88u firmware
- canonical/asus rt-ax92u firmware
- canonical/asus rt-g32
- canonical/asus rt-n10+ d1 firmware
- canonical/asus rt-n10e firmware
- canonical/asus rt-n14u firmware
- canonical/asus rt-n16 firmware
- canonical/asus rt-n19 firmware
- canonical/asus rt-n56r
- canonical/asus rt-n56u firmware
- canonical/asus rt-n600 firmware
- canonical/asus rt-n65u firmware
- canonical/asus rt-n66r
- canonical/asus rt-n66u firmware