V
Scaner-VS
HomeCatalogSourcesCWECAPECATT&CKMitigationsProductsVendorsDocs
CVE-2018-6000
CVE
CriticalConfirmedExploit available

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides…

CVSS
9.8
Critical
EPSS
0.84
p99
Published
2018-01-01
Updated
2018-01-01
Description

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.

Tags · CWE
Pre-auth
CWE-862
CAPEC-665
Affected products
Asuswrt < 3.0.0.4.384_10007
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
2018-01-01
Published
2018-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: N
None (N)
User Interaction
UI: N
None (N)
Scope
S: U
Unchanged (U)
Confidentiality Impact
C: H
High (H)
Integrity Impact
I: H
High (H)
Availability Impact
A: H
High (H)
Exploit indicators
EPSS
0.845 · p99
Known exploited (KEV)
No
MITRE ATT&CK
Inferred via CAPEC
└ via CAPEC-665 · CWE-862
└ via CAPEC-665 · CWE-862
└ via CAPEC-665 · CWE-862
Known exploits — Сканер-ВС
43881
exploitdb · https://www.exploit-db.com/exploits/43881
Enterprise
44176
exploitdb · https://www.exploit-db.com/exploits/44176
Enterprise
Affected products
ProductVendorStatus
asuswrt*Tracked
Source databases
CVE