CVE-2018-14714

CRITICAL

ASUS RT-AC3200 <3.0.0.4.382.50010 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2018-14714. PoCs published by BTtea, sunn1day, tin-z.

AI-analyzed exploit summary This is a functional exploit PoC for CVE-2018-14714, targeting ASUS routers with a command injection vulnerability in the `appGet.cgi` endpoint. It includes authentication, vulnerability checks, and a pseudo-shell for command execution.

Description

System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "load_script" URL parameter.

Exploits (4)

nomisec WORKING POC 18 stars
by BTtea · poc
https://github.com/BTtea/CVE-2018-14714-RCE-exploit

This is a functional exploit PoC for CVE-2018-14714, targeting ASUS routers with a command injection vulnerability in the `appGet.cgi` endpoint. It includes authentication, vulnerability checks, and a pseudo-shell for command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ASUS RT-N18U (firmware versions below 3.0.0.4.384.32738 or 3.0.0.4.384.45149)
Auth required
Prerequisites: Valid credentials for the target router · Network access to the target device · Vulnerable firmware version
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 9 stars
by sunn1day · poc
https://github.com/sunn1day/CVE-2018-14714-POC

This PoC demonstrates a command injection vulnerability in ASUS RT-AC3200 routers via the 'load_script' parameter in appGet.cgi. It creates a file to verify exploitation success.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ASUS RT-AC3200 (and other models) firmware versions listed in README
No auth needed
Prerequisites: Network access to the target router's web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB 6 stars
by tin-z · poc
https://github.com/tin-z/CVE-2018-14714-POC

This repository is a stub containing only a README.md that redirects to another repository for the actual CVE-2018-14714 PoC. No exploit code or technical details are present.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by BreadSquad · poc
https://github.com/BreadSquad/TimeInjector

This is a functional exploit script for CVE-2018-14714, which targets a command injection vulnerability in D-Link routers. It includes authentication, vulnerability checking via time-based injection, and interactive shell capabilities.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: D-Link routers (specific models affected by CVE-2018-14714)
Auth required
Prerequisites: valid credentials for the target device · network access to the target · presence of the vulnerable endpoint (/appGet.cgi)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.2741
EPSS Percentile 97.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (1)
asus/rt-ac3200_firmware 3.0.0.4.382.50010
Published May 13, 2019
Tracked Since Feb 18, 2026