Asuswrt Merlin is a custom firmware project for ASUS routers, with reported vulnerabilities concentrated across a family of consumer and small-business wireless access points and routers such as the RT-AC series. The observed weakness classes have not yet crystallized into a durable pattern; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Asuswrt Merlin over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-18320CRITICAL An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor | Oct 15, 2018 | 9.8 | 33 | NO | NO |
CVE-2018-18319CRITICAL An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated b | Oct 15, 2018 | 9.8 | 32 | NO | NO |
CVE-2017-11420CRITICAL Stack-based buffer overflow in ASUS_Discovery.c in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-A | Jul 18, 2017 | 9.8 | 32 | NO | NO |
CVE-2022-26376CRITICAL A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted H | Aug 5, 2022 | 9.8 | 30 | NO | NO |
CVE-2018-5721HIGH Stack-based buffer overflow in the ej_update_variables function in router/httpd/web.c on ASUS routers (when using software from https://github.com/RMerl/asuswrt-merlin) allows web | Jan 17, 2018 | 8.8 | 27 | NO | NO |
CVE-2017-12754HIGH Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67_0RT-AC5300 and earlier for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC | Aug 9, 2017 | 8.8 | 22 | NO | NO |
CVE-2018-8878MEDIUM Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire inform | Feb 27, 2020 | 5.3 | 21 | NO | NO |
CVE-2018-8877MEDIUM Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire inform | Feb 27, 2020 | 5.3 | 20 | NO | NO |
CVE-2017-11345HIGH Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B | Jul 17, 2017 | 7.8 | 20 | NO | NO |
CVE-2017-11344HIGH Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_ | Jul 17, 2017 | 7.8 | 20 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Asuswrt Merlin.
Media articles that mention a CVE ID that affects a product developed by Asuswrt Merlin — matched by CVE ID, not by vendor name.