What’s Vulnerable › Vulnerabilities

CVE-2018-18320

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-10-15 · updated 2026-06-17

Description

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution

Affected products

• Asuswrt-Merlin Project Rt-Ac1900 Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac2900 Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac3100 Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac3200 Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac5300 Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac56U Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac66U B1 Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac68P Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac68U Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac68Uf Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac86U Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac87 Firmware: through 380.70
• Asuswrt-Merlin Project Rt-Ac88U Firmware: through 380.70
• Asuswrt-Merlin Project Rt Ac1900P Firmware: through 380.70

References

• http://blog.51cto.com/010bjsoft/2298828
• https://github.com/qoli/Merlin.PHP/issues/26
• http://blog.51cto.com/010bjsoft/2298828
• https://github.com/qoli/Merlin.PHP/issues/26

Get alerted when CVE-2018-18320 or the next vulnerability affects your stack