CVE-2014-9583 is a critical authentication bypass and command execution vulnerability affecting ASUS WRT firmware versions, including those used in RT-AC66U and RT-N66U routers. The flaw in common.c's infosvr component allows remote attackers to bypass authentication and execute arbitrary commands by sending a specially crafted NET_CMD_ID_MANU_CMD packet to UDP port 9999. With a CVSS score of 10.0, this vulnerability poses a severe risk due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, exploit modules are publicly available in Metasploit and ExploitDB, indicating a high likelihood of exploitation. The vulnerability has garnered significant community discussion and media coverage, underscoring its importance.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0.0.4.376_3169CPE matchmatch criteria | cpe:2.3:o:t-mobile:tm-ac1900:3.0.0.4.376_3169:*:*:*:*:*:*:* | ||
3.0.0.4.376.2524-g0012f52CPE matchmatch criteria | cpe:2.3:o:asus:wrt_firmware:3.0.0.4.376.2524-g0012f52:*:*:*:*:*:*:* | ||
3.0.0.4.376_1071CPE matchmatch criteria | cpe:2.3:o:asus:wrt_firmware:3.0.0.4.376_1071:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.