CVE-2016-6558 | BDVDB-2026-104313 Detail

ASUSRP-AC52 Access Point

Description#

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the action_script parameter. The action_script parameter specifies a script to be executed if the action_mode parameter does not contain a valid state. If the input provided by action_script does not match one of the hard coded options, then it will be executed as the argument of either a system() or an eval() call allowing arbitrary commands to be executed.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

References#

https://www.securityfocus.com/bid/93596
https://www.kb.cert.org/vuls/id/763843

Exploit#

No public exploit known

History#

Version 12018-07-13Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.