CVE-2018-5721

8.8 highEPSS 1.9%

High (8.8) in asuswrt-merlin asuswrt-merlin. EPSS 1.9% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the ej_update_variables function in router/httpd/web.c on ASUS routers (when using software from https://github.com/RMerl/asuswrt-merlin) allows web authenticated attackers to execute code via a request that updates a setting. In ej_update_variables, the length of the variable action_script is not checked, as long as it includes a "_wan_if" substring.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-787
Published: 2018-01-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

asuswrt-merlin:asuswrt-merlin

References

http://www.w0lfzhang.com/2018/01/17/ASUS-router-stack-overflow-in-http-server/
http://www.w0lfzhang.com/2018/01/17/ASUS-router-stack-overflow-in-http-server/

Check your stack JSON