CVE-2016-6558
Description
A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the action_script parameter. The action_script parameter specifies a script to be executed if the action_mode parameter does not contain a valid state. If the input provided by action_script does not match one of the hard coded options, then it will be executed as the argument of either a system() or an eval() call allowing arbitrary commands to be executed.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asus rp-ac52_firmware | v ≤ 1.0.1.1s | — |
| asus ea-n66_firmware | No range specified | — |
| asus rp-n12_firmware | No range specified | — |
| asus rp-n14_firmware | No range specified | — |
| asus rp-n53_firmware | No range specified | — |
| asus rp-ac56_firmware | No range specified | — |
| asus wmp-n12_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.