What’s Vulnerable › Vulnerabilities

CVE-2016-6558: The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injection

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-13 · updated 2026-06-17
• Weakness: CWE-77

Description

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the action_script parameter. The action_script parameter specifies a script to be executed if the action_mode parameter does not contain a valid state. If the input provided by action_script does not match one of the hard coded options, then it will be executed as the argument of either a system() or an eval() call allowing arbitrary commands to be executed.

Affected products

• ASUS Ea-N66 Firmware: all versions
• ASUS Rp-Ac52 Firmware: through 1.0.1.1s
• ASUS Rp-Ac56 Firmware: all versions
• ASUS Rp-N12 Firmware: all versions
• ASUS Rp-N14 Firmware: all versions
• ASUS Rp-N53 Firmware: all versions
• ASUS Wmp-N12 Firmware: all versions

References

• https://www.kb.cert.org/vuls/id/763843
• https://www.securityfocus.com/bid/93596
• https://www.kb.cert.org/vuls/id/763843
• https://www.securityfocus.com/bid/93596

Get alerted when CVE-2016-6558 or the next vulnerability affects your stack