CVE-2018-5999: AsusWRT HTTPd processes POST requests after failed authentication

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 3.0 rates this 9.8 with no authentication or interaction required, and public exploit code plus a very high EPSS score make exploitation likely for exposed devices.

What it is

AsusWRT before 3.0.0.4.384_10007 has a flaw in the handle_request function in router/httpd/httpd.c where POST request processing continues even when authentication fails. This lets unauthenticated requests reach functionality that should require a valid login, which matters because the router's management interface is the control point for the whole device.

Impact

An attacker gains unauthenticated access to POST-handling functionality on the router, with the potential for full compromise of confidentiality, integrity and availability given the CVSS 3.0 base score of 9.8.

Attack surface

Reachable over the network via HTTP POST requests to the router's httpd service; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit code exists, including Metasploit and Exploit-DB entries, and EPSS is 0.87264 (99.7th percentile); the CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Upgrade AsusWRT to 3.0.0.4.384_10007 or later as the primary fix.
• If immediate upgrade is not possible, disable remote/WAN administration and restrict the router's web interface to trusted LAN hosts only.
• Change default administrative credentials and disable any unused management services on the device.
• Segment or isolate the router's management interface from untrusted networks until patched.

Detection

• Monitor httpd logs and network traffic for POST requests to the router's web interface that are followed by successful responses despite failed or absent authentication.
• Alert on unexpected POST requests originating from WAN-side or non-administrative source addresses.
• Watch for known exploit payload patterns from the public Metasploit module and Exploit-DB entries against the router's httpd.
• Audit router configuration changes and unexpected process activity that could indicate post-exploitation use of the bypass.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.