Read the docs
TI-2017-08447 Aliases CVE-2017-11420GHSA-2pp8-vrh8-g482

Stack-based buffer overflow in ASUS_Discovery.c in networkmap in Asuswrt-Merlin firmware…

Priority MEDIUM 51CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Stack-based buffer overflow in ASUS_Discovery.c in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code via long device information that is mishandled during a strcat to a device list.

Why it matters now

EPSS 0.05607 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 56

CPEVersionsRoleVendor
cpe:2.3:o:asuswrt-merlin_project:rt-ac5300_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac5300:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt_ac1900p_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt_ac1900p_:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac68u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac68u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac68p_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac68p:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac88u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac88u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac5300_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac5300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt_ac1900p_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt_ac1900p_:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac68u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac68u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac68p_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac68p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac88u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac88u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
Show 46 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:asuswrt-merlin_project:rt-ac66u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac66u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac66u_b1_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac66u_b1:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac58u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7485VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac58u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac56u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac56u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac55u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7378VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac55u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac52u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.4180VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac52u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac51u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7378VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac51u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n18u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n18u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n66u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7378VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n66u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n56u_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.378.7177VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n56u:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac3200_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac3200:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac3100_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7743VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac3100:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt_ac1200gu_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.5577VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt_ac1200gu:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt_ac1200g_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.3167VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt_ac1200g:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac1200_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.9880VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac1200:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-ac53_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.9883VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-ac53:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n12hp_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.2943VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n12hp:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n12hp_b1_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.3479VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n12hp_b1:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n12d1_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7378VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n12d1:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n12\+_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7378VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n12\+:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt_n12\+_pro_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.9880VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt_n12\+_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n16_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7378VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n16:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
cpe:2.3:o:asuswrt-merlin_project:rt-n300_firmware:*:*:*:*:*:*:*:*up to 3.0.0.4.380.7378VulnerableAsuswrt-merlin Project
cpe:2.3:h:asuswrt-merlin_project:rt-n300:-:*:*:*:*:*:*:*not specified by NVDRunning onAsuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac66u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac66u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac66u_b1_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac66u_b1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac58u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7485 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac58u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac56u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac56u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac55u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7378 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac55u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac52u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.4180 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac52u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac51u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7378 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac51u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n18u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n18u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n66u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7378 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n66u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n56u_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.378.7177 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n56u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac3200_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac3200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac3100_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7743 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac3100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt_ac1200gu_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.5577 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt_ac1200gu:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt_ac1200g_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.3167 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt_ac1200g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac1200_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.9880 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac1200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-ac53_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.9883 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-ac53:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n12hp_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.2943 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n12hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n12hp_b1_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.3479 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n12hp_b1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n12d1_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7378 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n12d1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n12\+_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7378 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n12\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt_n12\+_pro_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.9880 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt_n12\+_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n16_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7378 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n16:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project
  • cpe:2.3:o:asuswrt-merlin_project:rt-n300_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.0.4.380.7378 Vulnerable ·Asuswrt-merlin Project
  • cpe:2.3:h:asuswrt-merlin_project:rt-n300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Asuswrt-merlin Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11420
  2. 2026-10-03 Alias added: GHSA-2pp8-vrh8-g482

References

Exploit 1

Other 1

  • TI-2017-08382 Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS… CVSS 3.0HIGH 7.8
  • TI-2017-08383 Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS… CVSS 3.0HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences