CVE-2018-9285: ASUS Rt-AC1900 Firmware

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices before 3.0.0.4.382.39935; RT-AC87U and RT-AC3200 devices before 3.0.0.4.382.50010; and RT-AC5300 devices before 3.0.0.4.384.20287 allows OS command injection via the pingCNT and destIP fields of the SystemCmd variable.

Affected products

ASUS Rt-AC1900 Firmware: before 3.0.0.4.384.10007 (fixed in 3.0.0.4.384.10007)
ASUS Rt-AC2900 Firmware: before 3.0.0.4.384.10007 (fixed in 3.0.0.4.384.10007)
ASUS Rt-AC3100 Firmware: before 3.0.0.4.384.10007 (fixed in 3.0.0.4.384.10007)
ASUS Rt-AC3200 Firmware: before 3.0.0.4.382.50010 (fixed in 3.0.0.4.382.50010)
ASUS Rt-AC5300 Firmware: before 3.0.0.4.384.20287 (fixed in 3.0.0.4.384.20287)
ASUS Rt-AC66U Firmware: before 3.0.0.4.384.10007 (fixed in 3.0.0.4.384.10007)
ASUS Rt-AC68U Firmware: before 3.0.0.4.384.10007 (fixed in 3.0.0.4.384.10007)
ASUS Rt-AC86U Firmware: before 3.0.0.4.384.10007 (fixed in 3.0.0.4.384.10007)
ASUS Rt-AC87U Firmware: before 3.0.0.4.382.50010 (fixed in 3.0.0.4.382.50010)
ASUS Rt-AC88U Firmware: before 3.0.0.4.384.10007 (fixed in 3.0.0.4.384.10007)
ASUS Rt-n18u Firmware: before 3.0.0.4.382.39935 (fixed in 3.0.0.4.382.39935)

Published 2018-04-04. Last modified 2026-06-17.