CVE-2018-5721

Stack-based buffer overflow in the ej_update_variables function in router/httpd/web.c on ASUS routers (when using software from https://github.com/RMerl/asuswrt-merlin) allows web authenticated attackers to execute code via a request that updates a setting. In ej_update_variables, the length of the variable action_script is not checked, as long as it includes a "_wan_if" substring.
References
Configurations

Configuration 1 (hide)

cpe:2.3:o:asuswrt-merlin:asuswrt-merlin:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-01-17 06:29

Updated : 2024-02-28 16:04


NVD link : CVE-2018-5721

Mitre link : CVE-2018-5721

CVE.ORG link : CVE-2018-5721


JSON object : View

Products Affected

asuswrt-merlin

  • asuswrt-merlin
CWE
CWE-787

Out-of-bounds Write