398 matches found
CVE-2020-15498
An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.38520253. The router accepts an arbitrary server certificate for a firmware update. The culprit is the --no-check-certificate option passed to wget tool used to download firmware update files...
CVE-2018-20335
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APPInstallation.asp?= URI...
ASUSWRT Command Injection Vulnerability
ASUSWRT is a firmware from Asus Taiwan, China that runs in its routers. A command injection vulnerability exists in ASUS ASUSWRT version 3.0.0.4.384.20308. The vulnerability arises from a network system or product not properly filtering specific elements of externally entered data during the...
ASUS WRT-AC66U Cross-Site Scripting Vulnerability (CNVD-2020-04914)
The ASUS WRT-AC66U is a product of Asus Taiwan, China. A cross-site scripting vulnerability exists in the ASUS WRT-AC66U. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...
CVE-2018-8879
Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...
ASUS RT-N10+ 2.0.3.4 CSRF / XSS / Command Execution
Exploit Title: XSS And CSRF to RCE in ASUS RT-N10 Repeater Mode Date: 13/10/2019 Exploit Author: Matheus Vrech Vendor Homepage: https://www.asus.com/ Version: ASUS RT-N10+, Firmware: 2.0.3.4 Tested on: Archlinux, Windows 10 XSS: when someone change router to repeater mode you should be able to...
CVE-2018-14710
Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the "hook" URL parameter...
CVE-2018-18287
On ASUS RT-AC58U 3.0.0.4.3806516 devices, remote attackers can discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of the MainLogin.asp page...
CVE-2018-18291
A cross site scripting XSS vulnerability on ASUS RT-AC58U 3.0.0.4.3806516 devices allows remote attackers to inject arbitrary web script or HTML via AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp, AdvancedWirelessContent.asp, Logout.asp, MainLogin.asp, MobileQISLogin.asp, QISwizard.htm...
CVE-2018-17127
blockingrequest.cgi on ASUS GT-AC5300 devices through 3.0.0.4.38432738 allows remote attackers to cause a denial of service NULL pointer dereference and device crash via a request that lacks a timestap parameter...
ASUS GT-AC5300 Denial of Service Vulnerability (CNVD-2018-19561)
The ASUS GT-AC5300 is a wireless router from ASUS. A security vulnerability exists in the blockingrequest.cgi file in the ASUS GT-AC5300 3.0.0.4.38432738 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of service null pointer backreference and device crash...
CVE-2018-17023
Cross-site request forgery CSRF vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.38432738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to startapply.htm...
CVE-2018-17022
Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.38432738 allows remote attackers to cause a denial of service device crash or possibly have unspecified other impact by setting a long shpath0 value and then sending an appGet.cgi?hook=selectlist"StoragexSharedPath" request,...
CVE-2018-17022
Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.38432738 allows remote attackers to cause a denial of service device crash or possibly have unspecified other impact by setting a long shpath0 value and then sending an appGet.cgi?hook=selectlist"StoragexSharedPath" request,...
ASUS DSL-N12E_C1 Remote Command Execution Vulnerability
ASUS DSL-N12EC1 is a wireless router product from ASUS. A remote command execution vulnerability exists in the MainAnalysisContent.asp file in the ASUS DSL-N12EC1 version 1.1.2.3345. A remote attacker can exploit this vulnerability to execute arbitrary operating system commands with the help of...
CVE-2018-15887
MainAnalysisContent.asp in ASUS DSL-N12EC1 1.1.2.3345 is prone to Authenticated Remote Command Execution, which allows a remote attacker to execute arbitrary OS commands via service parameters, such as shell metacharacters in the destIP parameter of a cmdMethod=ping request...
ASUS RT-AC1200HP Cross-Site Scripting Vulnerability
ASUS RT-AC1200HP is a wireless router product from ASUS. A cross-site scripting vulnerability exists in the ASUS RT-AC1200HP using firmware versions prior to 3.0.0.4.380.4180. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
ASUS RT-AC68U Cross-Site Scripting Vulnerability (CNVD-2018-09580)
ASUS RT-AC68U is an enterprise-class wireless router product from ASUS. A cross-site scripting vulnerability exists in the ASUS RT-AC68U using firmware versions prior to 3.0.0.4.378.9383. A remote attacker can exploit the vulnerability to inject arbitrary web script or HTML...