CVE-2018-8877

MEDIUM

ASUS and Asuswrt-Merlin Firmware - Information Disclosure via new_lan_ip Variable

Title source: llm

Description

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the new_lan_ip variable on the error_page.htm page.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://github.com/outofhere/Research/blob/master/2018/Asus/cve_notes.md

Scores

CVSS v3 5.3

EPSS 0.0048

EPSS Percentile 65.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

asus/asus_firmware < 3.0.0.4.382.50470

asuswrt-merlin/asuswrt-merlin < 384.4

Published Feb 27, 2020

Tracked Since Feb 18, 2026