High severity8.8NVD Advisory· Published Jan 17, 2018· Updated Jun 17, 2026
CVE-2018-5721
CVE-2018-5721
Description
Stack-based buffer overflow in the ej_update_variables function in router/httpd/web.c on ASUS routers (when using software from https://github.com/RMerl/asuswrt-merlin) allows web authenticated attackers to execute code via a request that updates a setting. In ej_update_variables, the length of the variable action_script is not checked, as long as it includes a "_wan_if" substring.
Affected products
4cpe:2.3:o:asuswrt-merlin:asuswrt-merlin:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:asuswrt-merlin:asuswrt-merlin:*:*:*:*:*:*:*:*range: <=382.1_2
- (no CPE)
- (no CPE)
Patches
Vulnerability mechanics
References
1- www.w0lfzhang.com/2018/01/17/ASUS-router-stack-overflow-in-http-server/nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.