CVE-2018-8877

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-27 · updated 2026-06-17
Weakness: CWE-200

Description

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the new_lan_ip variable on the error_page.htm page.

Affected products

Asus Firmware: before 3.0.0.4.382.50470 — fixed in 3.0.0.4.382.50470
Asuswrt-Merlin: before 384.4 — fixed in 384.4

How to fix

Upgrade to a fixed version: Asus Firmware 3.0.0.4.382.50470; Asuswrt-Merlin 384.4. Check the vendor advisory for mitigations.

References

https://github.com/outofhere/Research/blob/master/2018/Asus/cve_notes.md
https://github.com/outofhere/Research/blob/master/2018/Asus/cve_notes.md

Get alerted when CVE-2018-8877 or the next vulnerability affects your stack