Description
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt ↗
- https://www.exploit-db.com/exploits/44176/ ↗
- https://blogs.securiteam.com/index.php/archives/3589 ↗
- https://www.exploit-db.com/exploits/43881/ ↗
- https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb ↗