An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| asuswrt-merlin_project | rt-ac5300_firmware | 380.70 | - |
| asuswrt-merlin_project | rt_ac1900p_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac68u_firmware |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
14
Affected Products
4
References
asuswrt-merlin_project / rt-ac5300_firmware
| 380.70 |
| - |
| asuswrt-merlin_project | rt-ac68p_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac88u_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac66u_b1_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac56u_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac3200_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac68uf_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac87_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac3100_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac1900_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac86u_firmware | 380.70 | - |
| asuswrt-merlin_project | rt-ac2900_firmware | 380.70 | - |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability
Impact