JVN#71329812: WL-330NUL vulnerable to cross-site request forgery

WL-330NUL provided by ASUS Japan Inc. is a portable wireless LAN router. WL-330NUL contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in the management screen, unintended operations may be performed on the device. Solution Update the...

CVE-2016-6558

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the actionscript parameter. The actionscript parameter specifies a script to be executed if the actionmode parameter does not conta...

CVE-2016-6557

In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface does not sufficiently verify whether a valid request was intentionally provided by the user. An attacker can perform actions with the same permissions as a victim user, provided...

CVE-2016-6558

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the actionscript parameter. The actionscript parameter specifies a script to be executed if the actionmode parameter does not conta...

CVE-2016-6557

In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface does not sufficiently verify whether a valid request was intentionally provided by the user. An attacker can perform actions with the same permissions as a victim user, provided...

Command injection

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the actionscript parameter. The actionscript parameter specifies a script to be executed if the actionmode parameter does not conta...

Server side request forgery (ssrf)

In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface does not sufficiently verify whether a valid request was intentionally provided by the user. An attacker can perform actions with the same permissions as a victim user, provided...

CVE-2016-6557 The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to cross-site request forgery

In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface does not sufficiently verify whether a valid request was intentionally provided by the user. An attacker can perform actions with the same permissions as a victim user, provided...

CVE-2016-6558 The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injection

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the actionscript parameter. The actionscript parameter specifies a script to be executed if the actionmode parameter does not conta...

CVE-2016-6557

The CVE-2016-6557 issue affects ASUS RP-AC52 (firmware 1.0.1.1s and possibly earlier). The web interface fails to sufficiently verify that a request is intentional, allowing CSRF where an attacker can perform actions with the victim’s permissions if the victim has an active session and is induced...

CVE-2016-6558

CVE-2016-6558 describes a command injection in the ASUS RP-AC52 web interface via apply.cgi, specifically in the action_script parameter. If action_script does not match a hard-coded option, input is passed to system() or eval(), enabling arbitrary commands. Affected firmware is 1.0.1.1s and poss...

VulnCheck KEV: CVE-2017-6549

Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware...

VulnCheck KEV: CVE-2014-9583

common.c in infosvr in ASUS WRT firmware 3.0.0.4.3761071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via...

VulnCheck KEV: CVE-2017-8877

ASUS RT-AC and RT-N devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID...

ASUS WRT-AC66U 3.x Cross Site Scripting

Document Title: =============== ASUS WRT-AC66U 3.x - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1993 Release Date: ============= 2018-06-27 Vulnerability Laboratory ID VL-ID: ====================================...

ASUS WRT-AC66U Cross-Site Scripting Vulnerability

The WRT-AC66U is a router product from ASUS. A cross-site scripting vulnerability exists in the ASUS WRT-AC66U version 3.x, which allows remote attackers to inject malicious script code into the application side of a vulnerable feature or service module...

ASUS WRT-AC66U 3.x - Cross Site Scripting Vulnerability

Document Title: =============== ASUS WRT-AC66U 3.x - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1993 Release Date: ============= 2018-06-27 Vulnerability Laboratory ID VL-ID: ====================================...

ASUS WRT-AC66U 3.x - Cross Site Scripting Vulnerability

Document Title: =============== ASUS WRT-AC66U 3.x - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1993 Release Date: ============= 2018-06-26 Vulnerability Laboratory ID VL-ID: ====================================...

AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password)

Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery Change Admin Password Date: 2018-06-23 Exploit Author: Wadeek Vendor Homepage: https://www.asus.com/ Firmware Link: http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC750GF/FWRTAC750GF30043806038.zip Firmware Version: 3.0.0.4.380.6038...

loja.asus.com.br XSS vulnerability

Open Bug Bounty ID: OBB-633478 Description| Value ---|--- Affected Website:| loja.asus.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...