CVE-2018-6000: AsusWRT vpnupload.cgi missing authorization allows admin password reset

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or user interaction required, public exploit code, and full administrative compromise of the device.

What it is

The do_vpnupload_post function in router/httpd/web.c in AsusWRT before 3.0.0.4.384_10007 lets a request set NVRAM configuration values without authorization. An attacker can use this to set the admin password and start an SSH daemon or enable infosvr command mode, gaining remote administrative control of the router.

Impact

An attacker gains full remote administrative access to the router, including the ability to change the admin password and enable remote services such as SSH. This yields complete compromise of confidentiality, integrity and availability of the device.

Attack surface

Reachable over the network via a crafted HTTP request to vpnupload.cgi; the CVSS vector shows no privileges and no user interaction required. Per the description, unauthenticated exploitation depends on chaining with CVE-2018-5999.

Exploitation

Not listed in CISA KEV, but EPSS is 0.85161 (99.7th percentile) and multiple references are tagged Exploit, including Metasploit and Exploit-DB entries, indicating public exploit code exists.

What to do

• Update AsusWRT to version 3.0.0.4.384_10007 or later, which is the fixed release named in the advisory.
• If immediate patching is not possible, disable remote access to the router web interface and restrict administrative access to trusted internal networks only.
• Change the router admin password after patching and disable any SSH daemon or infosvr command mode that is not required.
• Segment or isolate router management interfaces from untrusted networks and monitor for unexpected configuration changes.

Detection

• Monitor router and web logs for requests to vpnupload.cgi, especially POST requests from unexpected or external sources.
• Alert on unexpected changes to NVRAM configuration, admin credentials, or enabling of SSH or infosvr services.
• Watch for new or unexpected SSH daemon activity or inbound SSH connections to the router.
• Correlate vpnupload.cgi access with CVE-2018-5999 exploitation attempts in the same session or timeframe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.