CVE-2018-6000

CRITICAL EXPLOITED

AsusWRT <3.0.0.4.384_10007 - Privilege Escalation

Title source: llm

Exploitation Summary

CVE-2018-6000 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including Metasploit, Pedro Ribeiro, Pedro Ribeiro <[email protected]>, including a Metasploit module exploits/linux/http/asuswrt_lan_rce.

AI-analyzed exploit summary This Metasploit module exploits CVE-2018-6000 in AsusWRT routers by setting the `ateCommand_flag` via a POST request to `/vpnupload.cgi` and then sending a UDP packet to port 9999 to execute arbitrary commands as root. It starts a telnetd service on a random port for interactive shell access.

Description

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.

Exploits (3)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotehardware

https://www.exploit-db.com/exploits/44176

View Code ZIP pw:eip

This Metasploit module exploits CVE-2018-6000 in AsusWRT routers by setting the `ateCommand_flag` via a POST request to `/vpnupload.cgi` and then sending a UDP packet to port 9999 to execute arbitrary commands as root. It starts a telnetd service on a random port for interactive shell access.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: AsusWRT < v3.0.0.4.384.10007

No auth needed

Prerequisites: Network access to the target router's LAN interface · UDP port 9999 accessible · HTTP port 80 accessible

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1210 - Exploitation of Remote Services

devstral-2 · analyzed Feb 16, 2026 Full analysis →

exploitdb WRITEUP

by Pedro Ribeiro · textremotehardware

https://www.exploit-db.com/exploits/43881

View Code ZIP pw:eip

This is a detailed writeup describing two vulnerabilities (CVE-2018-5999 and CVE-2018-6000) in AsusWRT routers, including an authentication bypass and unauthenticated NVRAM configuration manipulation leading to remote code execution. The document explains the technical details, exploitation steps, and references related tools like a Metasploit module.

Classification

Writeup 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: AsusWRT (versions before v3.0.0.4.384.10007)

No auth needed

Prerequisites: Network access to the LAN · Vulnerable AsusWRT firmware version

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC EXCELLENT

by Pedro Ribeiro <[email protected]> · rubypocunix

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/asuswrt_lan_rce.rb

View Code ZIP pw:eip

This Metasploit module exploits an unauthenticated RCE vulnerability in AsusWRT by setting a NVRAM variable via HTTP POST and sending a crafted UDP packet to execute arbitrary commands as root. It spawns a telnetd service for interactive shell access.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: AsusWRT < v3.0.0.4.384.10007

No auth needed

Prerequisites: Network access to the AsusWRT HTTP portal (port 80) and UDP port 9999

MITRE ATT&CK