CVE-2018-8879

Name of the Vulnerable Software and Affected Versions: Asuswrt-Merlin firmware versions prior to 384.4 ASUS firmware versions prior to 3.0.0.4.382.50470

Description: The issue allows remote attackers to execute arbitrary code by providing a long string to the "blocking.asp" page via a GET or POST request. Vulnerable parameters are flag, mac, and cat id.

Recommendations: For Asuswrt-Merlin firmware versions prior to 384.4, update to version 384.4 or later. For ASUS firmware versions prior to 3.0.0.4.382.50470, update to version 3.0.0.4.382.50470 or later. As a temporary workaround, consider restricting access to the "blocking.asp" page to minimize the risk of exploitation. Avoid using the parameters flag, mac, and cat id in the affected page until the issue is resolved.