CVE-2018-8878

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-27 · updated 2026-06-17
Weakness: CWE-200

Description

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network devices' hostnames and MAC addresses by reading the custom_id variable on the blocking.asp page.

Affected products

Asus Firmware: before 3.0.0.4.382.50470 — fixed in 3.0.0.4.382.50470
Asuswrt-Merlin: before 384.4 — fixed in 384.4

How to fix

Upgrade to a fixed version: Asus Firmware 3.0.0.4.382.50470; Asuswrt-Merlin 384.4. Check the vendor advisory for mitigations.

References

https://github.com/outofhere/Research/blob/master/2018/Asus/cve_notes.md
https://github.com/outofhere/Research/blob/master/2018/Asus/cve_notes.md

Get alerted when CVE-2018-8878 or the next vulnerability affects your stack