Asuswrt-Merlin Project Rt-AC86U Firmware vulnerabilities

2 CVEs affecting Asuswrt-Merlin Project Rt-AC86U Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-18320, published 2018-10-15.

More from Asuswrt-Merlin Project.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-18319, published 2018-10-15. Critical severity, CVSS 9.8. EPSS: 5.4% chance of exploitation in the next 30 days. An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the…
• CVE-2018-18320, published 2018-10-15. Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days. An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that…