CVE-2017-12754 : Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67

Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67_0RT-AC5300 and earlier for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by sending a crafted http GET request packet that includes a long delete_offline_client parameter in the url.

Published 2017-08-09 15:29:00

Updated 2020-05-27 19:00:50

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2017-12754

Asuswrt-merlin » Asuswrt-merlin
Versions up to, including, (<=) 380.67
cpe:2.3:o:asuswrt-merlin:asuswrt-merlin:*:*:*:*:*:*:*:*
Matching versions
When used together with: Asuswrt-merlin » Rt-ac1200 » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac3100 » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac3200 » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac51u » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac52u » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac53 » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac5300 » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac55u » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac56u » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac58u » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac66u » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac66u B1 » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac68p » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac68u » Version: N/A
When used together with: Asuswrt-merlin » Rt-ac88u » Version: N/A
When used together with: Asuswrt-merlin » Rt-n12+ » Version: N/A
When used together with: Asuswrt-merlin » Rt-n12d1 » Version: N/A
When used together with: Asuswrt-merlin » Rt-n12hp » Version: N/A
When used together with: Asuswrt-merlin » Rt-n12hp B1 » Version: N/A
When used together with: Asuswrt-merlin » Rt-n16 » Version: N/A
When used together with: Asuswrt-merlin » Rt-n18u » Version: N/A
When used together with: Asuswrt-merlin » Rt-n300 » Version: N/A
When used together with: Asuswrt-merlin » Rt-n56u » Version: N/A
When used together with: Asuswrt-merlin » Rt-n66u » Version: N/A
When used together with: Asuswrt-merlin » Rt Ac1200g » Version: N/A
When used together with: Asuswrt-merlin » Rt Ac1200gu » Version: N/A
When used together with: Asuswrt-merlin » Rt Ac1900p » Version: N/A
When used together with: Asuswrt-merlin » Rt N12+ Pro » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-12754

EPSS FAQ

0.78%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-12754

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-12754

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-12754

https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/Asus_DeleteOfflineClientOverflow.txt

Wireless-Router-Vulnerability/Asus_DeleteOfflineClientOverflow.txt at master · coincoin7/Wireless-Router-Vulnerability · GitHub
Third Party Advisory
https://asuswrt.lostrealm.ca/changelog

Changelog 380.xx | Asuswrt-Merlin
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2017-12754

Products affected by CVE-2017-12754

Exploit prediction scoring system (EPSS) score for CVE-2017-12754

CVSS scores for CVE-2017-12754

CWE ids for CVE-2017-12754

References for CVE-2017-12754