CVE-2018-9285

Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices before 3.0.0.4.382.39935; RT-AC87U and RT-AC3200 devices before 3.0.0.4.382.50010; and RT-AC5300 devices before 3.0.0.4.384.20287 allows OS command injection via the pingCNT and destIP fields of the SystemCmd variable.

• CWE-78

• http://packetstormsecurity.com/files/160049/ASUS-TM-AC1900-Arbitrary-Command-Execution.html
• https://fortiguard.com/zeroday/FG-VD-17-216Third Party Advisory
• https://www.fortinet.com/blog/threat-research/fortiguard-labs-discovers-vulnerability-in-asus-router.htmlThird Party Advisory
• http://packetstormsecurity.com/files/160049/ASUS-TM-AC1900-Arbitrary-Command-Execution.html
• https://fortiguard.com/zeroday/FG-VD-17-216Third Party Advisory
• https://www.fortinet.com/blog/threat-research/fortiguard-labs-discovers-vulnerability-in-asus-router.htmlThird Party Advisory

Published

Apr 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9279An issue was discovered on Eaton UPS 9PX 8000 SP devices. Th…
• CVE-2018-9280An issue was discovered on Eaton UPS 9PX 8000 SP devices. Th…
• CVE-2018-9281An issue was discovered on Eaton UPS 9PX 8000 SP devices. Th…
• CVE-2018-9282An XSS issue was discovered in Subsonic Media Server 6.1.1. …
• CVE-2018-9283An XSS issue was discovered in CremeCRM 1.6.12. It is affect…
• CVE-2018-9284authentication.cgi on D-Link DIR-868L devices with Singapore…9.8
• CVE-2018-9302SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php…
• CVE-2018-9303In Exiv2 0.26, an assertion failure in BigTiffImage::readDat…
• CVE-2018-9304In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in…
• CVE-2018-9305In Exiv2 0.26, an out-of-bounds read in IptcData::printStruc…
• CVE-2018-9306Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-9307dsmall v20180320 allows XSS via the pdr_sn parameter to publ…