8.8

CVE-2017-12754

Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67_0RT-AC5300 and earlier for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by sending a crafted http GET request packet that includes a long delete_offline_client parameter in the url.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Asuswrt-merlin ≫ Asuswrt-merlin Version <= 380.67
   Asuswrt-merlin ≫ Rt-ac1200 Version-
   Asuswrt-merlin ≫ Rt-ac3100 Version-
   Asuswrt-merlin ≫ Rt-ac3200 Version-
   Asuswrt-merlin ≫ Rt-ac51u Version-
   Asuswrt-merlin ≫ Rt-ac52u Version-
   Asuswrt-merlin ≫ Rt-ac53 Version-
   Asuswrt-merlin ≫ Rt-ac5300 Version-
   Asuswrt-merlin ≫ Rt-ac55u Version-
   Asuswrt-merlin ≫ Rt-ac56u Version-
   Asuswrt-merlin ≫ Rt-ac58u Version-
   Asuswrt-merlin ≫ Rt-ac66u Version-
   Asuswrt-merlin ≫ Rt-ac66u B1 Version-
   Asuswrt-merlin ≫ Rt-ac68p Version-
   Asuswrt-merlin ≫ Rt-ac68u Version-
   Asuswrt-merlin ≫ Rt-ac88u Version-
   Asuswrt-merlin ≫ Rt-n12d1 Version-
   Asuswrt-merlin ≫ Rt-n12hp Version-
   Asuswrt-merlin ≫ Rt-n12hp B1 Version-
   Asuswrt-merlin ≫ Rt-n16 Version-
   Asuswrt-merlin ≫ Rt-n18u Version-
   Asuswrt-merlin ≫ Rt-n300 Version-
   Asuswrt-merlin ≫ Rt-n56u Version-
   Asuswrt-merlin ≫ Rt-n66u Version-
   Asuswrt-merlin ≫ Rt Ac1200g Version-
   Asuswrt-merlin ≫ Rt Ac1200gu Version-
   Asuswrt-merlin ≫ Rt Ac1900p Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.01% 0.923
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.