CVE-2017-15655

Vulnerability

Multiple buffer overflow vulnerabilities exist in the HTTPd server of ASUS asuswrt firmware versions up to and including 3.0.0.4.376.X. The bug is triggered via a crafted Host: header, which overflows a buffer and overwrites the SystemCmd variable. The vulnerable code path is reachable when an authenticated administrator visits certain pages, such as the network tools tab. All models running asuswrt <=3.0.0.4.376.X are affected; some end-of-life routers (e.g., RT-N65R, RT-N65U) receive this version as their last update and therefore remain vulnerable [1].

Exploitation

An attacker needs only to send an HTTP request with an overly long Host: header to the router's management interface. No authentication is required for the initial request, but exploitation completes only after an authenticated administrator later visits one of several trigger pages (e.g., the network tools tab). The attacker can embed arbitrary shell commands in the Host: header payload; the overflow overwrites SystemCmd with that payload. When the admin visits a trigger page, the injected command executes with root privileges [1].

Impact

Successful exploitation achieves remote code execution as the administrator (root) on the router. The attacker can fully compromise the device, including reading all NVRAM contents, modifying configurations, and exfiltrating sensitive data. Due to the network vector and the lack of required privileges for the initial overflow stage, the CVSS v3 score is 9.6 (Critical) [1].

Mitigation

The vendor fixed these issues in firmware version 3.0.0.4.378. Users should upgrade to this or a later version immediately. For routers that cannot be upgraded beyond 3.0.0.4.376.X (e.g., end-of-life models), ASUS has not released a patch — the vendor refused to fix the vulnerability for EOL devices [1]. Recommended workarounds include disabling remote management from the WAN side and restricting LAN access to the management interface only to trusted hosts. This CVE is not listed on the CISA KEV catalog as of this writing.