CyberRota
Live Feed
Return to register
Case File

CVE-2018-6000

CRITICAL · CVSS 9.8 EPSS 84.77% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-01-22 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

Exhibit — Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗
External Security References
raw.githubusercontent.com ↗ exploit-db.com ↗ exploit-db.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2018-6000
Severity
CRITICAL
CVSS
9.8
EPSS
84.77%

Original Filing — NVD Description

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.