CVE-2016-6558 The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injection
Attackers can execute arbitrary commands on ASUS RP-AC52 access points via the action_script parameter in the web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6558?
CVE-2016-6558 is a critical command injection vulnerability in ASUS RP-AC52 Access Point, published on 13 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the action_script parameter. The action_script parameter specifies a script to be executed if the action_mode parameter does not contain a valid state. If the input provided by action_script does not match one of the hard coded options, then it will be executed as the argument of either a system() or an eval() call allowing arbitrary commands to be executed.
Weakness: CWE-77
Which versions are affected by CVE-2016-6558?
It affects 7 products.
Products include Asus Ea-N66 Firmware, Asus Rp-Ac52 Firmware, Asus Rp-Ac56 Firmware, Asus Rp-N12 Firmware, Asus Rp-N14 Firmware, Asus Rp-N53 Firmware and 1 more.
How do I fix CVE-2016-6558?
No fix has been published for CVE-2016-6558 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-6558 being exploited?
There is no known exploitation of CVE-2016-6558 in the wild and no public exploit code.
Other vulnerabilities in ASUS RP-AC52 Access Point
Sources
Also known as GHSA-crrg-v4fm-59fp.