Medium severity5.3NVD Advisory· Published Feb 27, 2020· Updated Jun 17, 2026

CVE-2018-8878

Description

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network devices' hostnames and MAC addresses by reading the custom_id variable on the blocking.asp page.

Affected products

ASUS/Asuswrt-Merlin firmwaredescription
Rmerl/Asuswrt Merlinllm-create
Range: <384.4
Asus/Asus Firmwarellm-fuzzy
Range: <3.0.0.4.382.50470

Patches

Vulnerability mechanics

References

github.com/outofhere/Research/blob/master/2018/Asus/cve_notes.mdnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000