CVE-2018-14714: Undefined Security Weakness

System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "loadscript" URL parameter...

CVE-2018-14712: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the "hook" URL parameter...

PT-2019-9049 · Asus · Asus Rt-Ac3200

Name of the Vulnerable Software and Affected Versions: ASUS RT-AC3200 version 3.0.0.4.382.50010 Description: The issue allows attackers to execute system commands via the "load script" URL parameter in the appGet.cgi file. This can be exploited by sending a malicious request to the "/appGet.cgi"...

PT-2019-9047

Name of the Vulnerable Software and Affected Versions ASUS RT-AC3200 version 3.0.0.4.382.50010 Description A buffer overflow issue exists in the appGet.cgi of the affected device, allowing attackers to inject system commands. This can be achieved by manipulating the hook URL parameter...

PT-2019-9045

Name of the Vulnerable Software and Affected Versions ASUS RT-AC3200 version 3.0.0.4.382.50010 Description The issue allows attackers to execute JavaScript code via the hook URL parameter in the appGet.cgi endpoint. This enables cross-site scripting attacks. Recommendations For ASUS RT-AC3200...

PT-2019-9046

Name of the Vulnerable Software and Affected Versions ASUS RT-AC3200 version 3.0.0.4.382.50010 Description The issue is related to missing cross-site request forgery protection in the appGet.cgi file. This allows attackers to cause state-changing actions using specially crafted URLs...

CVE-2018-14713: Use of Externally-Controlled Format String

Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers via the "hook" URL parameter...

PT-2019-9048

Name of the Vulnerable Software and Affected Versions ASUS RT-AC3200 version 3.0.0.4.382.50010 Description The issue allows attackers to read arbitrary sections of memory and CPU registers. This is achieved via the hook URL parameter in the appGet.cgi. Recommendations For version 3.0.0.4.382.5001...

ASUS RT-AC58U Information Disclosure Vulnerability

ASUS RT-AC58U is a wireless router product from ASUS. A security vulnerability exists in ASUS RT-AC58U version 3.0.0.4.3806516. The vulnerability can be exploited by a remote attacker to obtain the hostname and IP address by reading the dhcpLeaseInfo data in the HTML source code of the...

Code injection

On ASUS RT-AC58U 3.0.0.4.3806516 devices, remote attackers can discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of the MainLogin.asp page...

Cross site scripting

A cross site scripting XSS vulnerability on ASUS RT-AC58U 3.0.0.4.3806516 devices allows remote attackers to inject arbitrary web script or HTML via AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp, AdvancedWirelessContent.asp, Logout.asp, MainLogin.asp, MobileQISLogin.asp, QISwizard.htm...

CVE-2018-18287

On ASUS RT-AC58U 3.0.0.4.3806516 devices, remote attackers can discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of the MainLogin.asp page...

CVE-2018-18291

A cross site scripting XSS vulnerability on ASUS RT-AC58U 3.0.0.4.3806516 devices allows remote attackers to inject arbitrary web script or HTML via AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp, AdvancedWirelessContent.asp, Logout.asp, MainLogin.asp, MobileQISLogin.asp, QISwizard.htm...

CVE-2018-18287

On ASUS RT-AC58U 3.0.0.4.3806516 devices, remote attackers can discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of the MainLogin.asp page...

CVE-2018-18291

A cross site scripting XSS vulnerability on ASUS RT-AC58U 3.0.0.4.3806516 devices allows remote attackers to inject arbitrary web script or HTML via AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp, AdvancedWirelessContent.asp, Logout.asp, MainLogin.asp, MobileQISLogin.asp, QISwizard.htm...

CVE-2018-18291

CVE-2018-18291 affects ASUS RT-AC58U (firmware 3.0.0.4.380_6516). It is a cross-site scripting (XSS) vulnerability, exploitable via multiple web interface pages (e.g., Advanced_ASUSDDNS_Content.asp, Advanced_WSecurity_Content.asp, Advanced_Wireless_Content.asp, Logout.asp, Main_Login.asp, etc.). ...

PT-2018-14392

Name of the Vulnerable Software and Affected Versions ASUS RT-AC58U version 3.0.0.4.380 6516 Description The issue allows remote attackers to discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of the "Main Login.asp" page. Recommendations For version...

PT-2018-14395

Name of the Vulnerable Software and Affected Versions ASUS RT-AC58U version 3.0.0.4.380 6516 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via various pages, including Advanced ASUSDDNS Content.asp, Advanced WSecurity Content.asp,...

CVE-2018-18291: Improper Neutralization of Input During Web Page Generation

A cross site scripting XSS vulnerability on ASUS RT-AC58U 3.0.0.4.3806516 devices allows remote attackers to inject arbitrary web script or HTML via AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp, AdvancedWirelessContent.asp, Logout.asp, MainLogin.asp, MobileQISLogin.asp, QISwizard.htm...

CVE-2018-18287: Exposure of Sensitive Information to an Unauthorized Actor

On ASUS RT-AC58U 3.0.0.4.3806516 devices, remote attackers can discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of the MainLogin.asp page...