CVE-2018-14714

CRITICAL

ASUS RT-AC3200 <3.0.0.4.382.50010 - Command Injection

Title source: llm

Description

System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "load_script" URL parameter.

Exploits (4)

nomisec WORKING POC 18 stars
by BTtea · poc
https://github.com/BTtea/CVE-2018-14714-RCE-exploit
nomisec WORKING POC 9 stars
by sunn1day · poc
https://github.com/sunn1day/CVE-2018-14714-POC
nomisec STUB 6 stars
by tin-z · poc
https://github.com/tin-z/CVE-2018-14714-POC
nomisec WORKING POC
by BreadSquad · poc
https://github.com/BreadSquad/TimeInjector

Scores

CVSS v3 9.8
EPSS 0.8102
EPSS Percentile 99.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (1)
asus/rt-ac3200_firmware 3.0.0.4.382.50010
Published May 13, 2019
Tracked Since Feb 18, 2026