Read the docs
TI-2018-06731 Aliases CVE-2018-9285GHSA-8g7r-fwgg-5qfg

Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U…

Priority MEDIUM 48CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices before 3.0.0.4.382.39935; RT-AC87U and RT-AC3200 devices before 3.0.0.4.382.50010; and RT-AC5300 devices before 3.0.0.4.384.20287 allows OS command injection via the pingCNT and destIP fields of the SystemCmd variable.

Why it matters now

EPSS 0.03557 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:o:asus:rt-ac66u_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.384.10007VulnerableASUS
cpe:2.3:h:asus:rt-ac66u:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-ac68u_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.384.10007VulnerableASUS
cpe:2.3:h:asus:rt-ac68u:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-ac86u_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.384.10007VulnerableASUS
cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-ac88u_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.384.10007VulnerableASUS
cpe:2.3:h:asus:rt-ac88u:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-ac1900_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.384.10007VulnerableASUS
cpe:2.3:h:asus:rt-ac1900:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
  • cpe:2.3:o:asus:rt-ac66u_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.384.10007 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac66u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-ac68u_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.384.10007 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac68u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-ac86u_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.384.10007 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-ac88u_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.384.10007 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac88u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-ac1900_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.384.10007 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac1900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:asus:rt-ac2900_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.384.10007VulnerableASUS
cpe:2.3:h:asus:rt-ac2900:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-ac3100_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.384.10007VulnerableASUS
cpe:2.3:h:asus:rt-ac3100:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-n18u_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.382.39935VulnerableASUS
cpe:2.3:h:asus:rt-n18u:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-ac87u_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.382.50010VulnerableASUS
cpe:2.3:h:asus:rt-ac87u:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-ac3200_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.382.50010VulnerableASUS
cpe:2.3:h:asus:rt-ac3200:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
cpe:2.3:o:asus:rt-ac5300_firmware:*:*:*:*:*:*:*:*before 3.0.0.4.384.20287VulnerableASUS
cpe:2.3:h:asus:rt-ac5300:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
  • cpe:2.3:o:asus:rt-ac2900_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.384.10007 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac2900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-ac3100_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.384.10007 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac3100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-n18u_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.382.39935 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-n18u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-ac87u_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.382.50010 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac87u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-ac3200_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.382.50010 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac3200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS
  • cpe:2.3:o:asus:rt-ac5300_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.4.384.20287 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac5300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-9285
  2. 2026-10-03 Alias added: GHSA-8g7r-fwgg-5qfg

References

Advisory 2

Other 1

  • TI-2021-02220 In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware <… CVSS 3.1HIGH 7.5
  • TI-2021-19533 ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1CRITICAL 9.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences