CVE-2023-34360

2023-07-3106:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-34360

nvd

information security

asus rt-ax88u

firmware

xss

cross-site scripting

security vulnerability

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

0.001 Low

EPSS

Percentile

20.9%

JSON

A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.23110 and prior. After a remote attacker logging in device with regular user privilege, the remote attacker can perform a Stored Cross-site Scripting (XSS) attack by uploading image which containing JavaScript code.

Affected configurations

NVD

Node

asusrt-ax88u_firmwareRange≤3.0.0.4.388.23110

AND

asusrt-ax88uMatch-

CPENameOperatorVersion
asus:rt-ax88u_firmwareasus rt-ax88u firmwarele3.0.0.4.388.23110

CPE	Name	Operator	Version
asus:rt-ax88u_firmware	asus rt-ax88u firmware	le	3.0.0.4.388.23110

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "RT-AX88U",
    "vendor": "ASUS",
    "versions": [
      {
        "lessThanOrEqual": "3.0.0.4.388.23110",
        "status": "affected",
        "version": "   ",
        "versionType": "custom"
      }
    ]
  }
]