CVE-2018-18319
📋 TL;DR
CVE-2018-18319 is a critical remote code execution vulnerability in Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. Attackers can execute arbitrary commands via the api.php endpoint using specially crafted URIs. This affects systems running the vulnerable Merlin.PHP component, typically on Asuswrt-Merlin router firmware.
💻 Affected Systems
- Merlin.PHP component for Asuswrt-Merlin
📦 What is this software?
Rt Ac1900 Firmware by Asuswrt Merlin Project
Rt Ac1900p Firmware by Asuswrt Merlin Project
Rt Ac2900 Firmware by Asuswrt Merlin Project
Rt Ac3100 Firmware by Asuswrt Merlin Project
Rt Ac3200 Firmware by Asuswrt Merlin Project
Rt Ac5300 Firmware by Asuswrt Merlin Project
Rt Ac56u Firmware by Asuswrt Merlin Project
Rt Ac66u B1 Firmware by Asuswrt Merlin Project
Rt Ac68p Firmware by Asuswrt Merlin Project
Rt Ac68u Firmware by Asuswrt Merlin Project
Rt Ac68uf Firmware by Asuswrt Merlin Project
Rt Ac86u Firmware by Asuswrt Merlin Project
Rt Ac87 Firmware by Asuswrt Merlin Project
Rt Ac88u Firmware by Asuswrt Merlin Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary commands with root privileges, install malware, pivot to internal networks, or brick the device.
Likely Case
Unauthenticated remote code execution leading to device takeover, credential theft, or network monitoring.
If Mitigated
Limited impact if component is disabled or network segmentation prevents external access.
🎯 Exploit Status
Exploit is trivial - demonstrated by simple HTTP request to api.php with command injection parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available. Vendor considers this intended functionality for trusted networks only.
🔧 Temporary Workarounds
Disable Merlin.PHP component
linuxRemove or disable the vulnerable Merlin.PHP component entirely
rm -rf /path/to/Merlin.PHP/
Disable via web interface if available
Network isolation
linuxEnsure Merlin.PHP is only accessible from trusted internal networks
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
🧯 If You Can't Patch
- Remove Merlin.PHP component completely from production systems
- Implement strict network segmentation and firewall rules to isolate affected devices
🔍 How to Verify
Check if Vulnerable:
Check if Merlin.PHP 0.6.6 is installed: ls -la /path/to/Merlin.PHP/ and check version filesCheck Version:
cat /path/to/Merlin.PHP/version.txt or check web interfaceVerify Fix Applied:
Verify Merlin.PHP component is removed or inaccessible: curl -v http://device-ip/6/api.php should fail📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /6/api.php with 'function=command&class=remote' parameters
- Unusual command execution in system logs
Network Indicators:
- HTTP POST/GET requests to api.php endpoint with command injection parameters
SIEM Query:
source="web_logs" AND uri_path="/6/api.php" AND (query_string="*function=command*" OR query_string="*class=remote*")