vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-18319

N/A
Published: October 15, 2018 at 06:00 AM UTC
Updated: June 17, 2026 at 01:46 AM UTC
28 products affected across 1 vendorRt AC68P FirmwareRt AC1900P FirmwareRt AC56U Firmware

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 5%

Description

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Rt AC1900 Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac1900 (same device)
Rt AC1900P Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac1900p (same device)
Rt AC2900 Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac2900 (same device)
Rt AC3100 Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac3100 (same device)
Rt AC3200 Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac3200 (same device)
Rt AC5300 Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac5300 (same device)
Rt AC56U Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac56u (same device)
Rt AC66U B1 Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac66u-b1 (same device)
Rt AC68P Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac68p (same device)
Rt AC68U Firmware· Asuswrt Merlin Project
95%
v ≤ 380.70
asuswrt-merlin-project-rt-ac68u (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
http://blog.51cto.com/010bjsoft/2298902
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://github.com/qoli/Merlin.PHP/issues/27

CVSS

7.5HIGH[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-94

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card