Loading vulnerability…
Authentication Bypass in AsusWRT handle_request POST Processing
CVE-2018-5999 is a critical authentication bypass vulnerability in AsusWRT before version 3.0.0.4.384_10007. The flaw is in the handle_request function in router/httpd/httpd.c, where processing of HTTP POST requests continues even after authentication fails. As a result, an unauthenticated remote attacker can submit crafted POST requests to administrative functionality and trigger configuration changes without valid credentials. Reported exploitation details indicate the issue can be used to enable unauthorized access to internal router management functionality and modify security-sensitive settings, including administrator credentials and other device configuration parameters. The vulnerability affects exposed ASUS router management interfaces and has been associated with full compromise scenarios on vulnerable devices.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker to bypass the router's administrative authentication controls and alter device configuration remotely. Observed and reported outcomes include unauthorized changes to administrative passwords, VPN settings, DDNS settings, port-related configuration, and other management options. In severe cases, exploitation has been described as enabling remote code execution with root privileges on affected routers, which would permit complete device takeover, botnet enrollment, persistence through configuration changes, and use of the router as infrastructure for further malicious activity such as denial-of-service operations.
If you can’t patch tonight, do this now.
Restrict or disable internet exposure of the router's administrative interface, especially HTTP-based management access from untrusted networks. Limit management access to trusted internal hosts or a secured management network, and disable remote administration if it is not operationally required. Where immediate patching is not possible, place the device behind upstream access controls, monitor for unexpected configuration changes, and consider replacing legacy hardware that cannot be updated. A factory reset followed by reconfiguration from a trusted baseline may be appropriate if unauthorized modification is suspected.
Patch, then assume compromise.
Upgrade affected ASUS routers to AsusWRT version 3.0.0.4.384_10007 or later, or to the vendor-provided fixed firmware for the specific model. Replace unsupported or end-of-life devices that no longer receive security updates. After patching, review the router configuration for unauthorized changes, reset administrative credentials, rotate any credentials stored on the device such as VPN or dynamic DNS secrets, and restore trusted configuration from a known-good baseline if compromise is suspected.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.