Vulnerability record · CVE-2018-18319 · published 15 October 2018
CVE-2018-18319: Asuswrt-merlin project rt-ac5300 firmware code injection vulnerability
Asuswrt Merlin Project · Rt Ac5300 Firmware
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution
Description
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
14 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://blog.51cto.com/010bjsoft/2298902 | ExploitThird Party Advisory |
| https://github.com/qoli/Merlin.PHP/issues/27 | ExploitThird Party Advisory |
| http://blog.51cto.com/010bjsoft/2298902 | ExploitThird Party Advisory |
| https://github.com/qoli/Merlin.PHP/issues/27 | ExploitThird Party Advisory |
Track CVE-2018-18319 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-18319), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.