PT-2019-11149
CVE-2018-8879
·
تاريخ النشر
2019-11-21
·
تاريخ التحديث
2019-12-04
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
Asuswrt-Merlin firmware versions prior to 384.4
ASUS firmware versions prior to 3.0.0.4.382.50470
Description:
The issue allows remote attackers to execute arbitrary code by providing a long string to the "blocking.asp" page via a GET or POST request. Vulnerable parameters are
flag, mac, and cat id.Recommendations:
For Asuswrt-Merlin firmware versions prior to 384.4, update to version 384.4 or later.
For ASUS firmware versions prior to 3.0.0.4.382.50470, update to version 3.0.0.4.382.50470 or later.
As a temporary workaround, consider restricting access to the "blocking.asp" page to minimize the risk of exploitation. Avoid using the parameters
flag, mac, and cat id in the affected page until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾