CVE-2018-8879

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-21 · updated 2026-06-17
Weakness: CWE-787

Description

Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters are flag, mac, and cat_id.

Affected products

ASUS Rt-Ac66U Firmware: before 3.0.0.4.382.50470 — fixed in 3.0.0.4.382.50470

How to fix

Upgrade to a fixed version: ASUS Rt-Ac66U Firmware 3.0.0.4.382.50470. Check the vendor advisory for mitigations.

References

https://pagedout.institute/download/PagedOut_001_beta1.pdf
https://www.asus.com/Networking/RTAC66U/HelpDesk_BIOS
https://pagedout.institute/download/PagedOut_001_beta1.pdf
https://www.asus.com/Networking/RTAC66U/HelpDesk_BIOS

Get alerted when CVE-2018-8879 or the next vulnerability affects your stack