CVE-2013-4937

CVE-2013-4937 describes multiple unspecified vulnerabilities in the AiCloud feature of Asus routers (models: RT-AC66U, RT-N66U, RT-N65U, RT-N14U, RT-N16, RT-N56U, DSL-N55U) with firmware before 3.0.4.372. Connected OpenVAS data identifies a concrete issue titled “Multiple Asus Router Directory Tr...

ASUS RT-AC66U ACSD Remote Root Buffer Overflow

!/usr/bin/env python import signal, struct from time import sleep from socket import from sys import exit, excinfo TitleASUS RT-AC66U Remote Root Shell Exploit - acsd param command Discovered and ReportedJune 2013 Discovered/Exploited ByJacob Holcomb/Gimppy and Jacob Thompson Security Analsyts @...

PT-2013-5285

Name of the Vulnerable Software and Affected Versions ASUS RT-AC66U versions prior to 3.0.4.372 ASUS RT-N66U versions prior to 3.0.4.372 ASUS RT-N65U versions prior to 3.0.4.372 ASUS RT-N14U versions prior to 3.0.4.372 ASUS RT-N16 versions prior to 3.0.4.372 ASUS RT-N56U versions prior to 3.0.4.3...

CVE-2013-4937: Undefined Security Weakness

Multiple unspecified vulnerabilities in the AiCloud feature on the ASUS RT-AC66U, RT-N66U, RT-N65U, RT-N14U, RT-N16, RT-N56U, and DSL-N55U with firmware before 3.0.4.372 have unknown impact and attack vectors...

ASUS Home Routers Vulnerable to Remote Attacks

Asus home routers are open to a number of potential remote attacks because of vulnerabilities in the AiCloud service bundled with the hardware. Security researcher Kyle Lovett posted on Sunday to the Full Disclosure mailing list today a follow up to a June disclosure of a directory traversal bug ...

Full Disclosure ASUS Wireless Routers Ten Models - Multiple Vulnerabilities on AiCloud enabled units

Note: In June I released a partial disclosure for just the RT-N66U on the issue of directory traversal. I have only heard back from ASUS a twice on the issue, and I understand they are working on a fix. However, no serious attempt to our knowledge has been made to warn their customers in the...

ASUS RT-N66U Router - HTTPS Directory traversal and full file access and credential disclosure vuln

Vulnerable product: ASUS RT-N66U when HTTPS WebService via AiCloud is enabled AC66R and RT-N65U are effected as well, but need more testing Vulnerabilities: - Linux 2.6.22 - Researched on both 3.0.0.4.270 and 3.0.0.4.354 firmware - Full directory traversal and plain text disclosure of all sensiti...

Asus routers security vulnerabilities

Information leakage, code execution...

Multiple Asus Router Directory Traversal Vulnerability

The remote Asus router is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ASUS RT-N66U Directory Traversal

Vulnerable product: ASUS RT-N66U when HTTPS WebService via AiCloud is enabled AC66R and RT-N65U are effected as well, but need more testing Vulnerabilities: - Linux 2.6.22 - Researched on both 3.0.0.4.270 and 3.0.0.4.354 firmware - Full directory traversal and plain text disclosure of all sensiti...

ASUS RT56U Router Multiple Vulnerabilities (Jun 2013) - Active Check

ASUS RT56U Router is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Asus RT56U 3.0.0.4.360 - Remote Command Injection

Asus RT56U 3.0.0.4.360 - Remote Command Injection Exploit Title: Asus RT56U Remote Command Injection Date: 05/05/2013 Exploit Author: drone @dronesec Vendor Homepage: asus.com Version: = 3.0.0.4.360 latest Device Details: ============== Router information: http://www.asus.com/Networking/RTN56U/...

ASUS RT56U Remote Command Injection

Exploit Title: Asus RT56U Remote Command Injection Date: 05/05/2013 Exploit Author: drone @dronesec Vendor Homepage: asus.com Version: = 3.0.0.4.360 latest Device Details: ============== Router information: http://www.asus.com/Networking/RTN56U/ Firmware:...

Asus RT56U 3.0.0.4.360 - Remote Command Injection

Router information: http://www.asus.com/Networking/RTN56U/ Firmware: http://www.asus.com/Networking/RTN56U/supportDownload30 Insufficient or rather, a complete lack thereof input sanitization leads to the injection of shell commands. It's possible to upload and execute a backdoor. Example request...

Asus RT56U 3.0.0.4.360 - Remote Command Injection

Exploit Title: Asus RT56U Remote Command Injection Date: 05/05/2013 Exploit Author: drone @dronesec Vendor Homepage: asus.com Version: = 3.0.0.4.360 latest Device Details: ============== Router information: http://www.asus.com/Networking/RTN56U/ Firmware:...

DefenseCode Security Advisory: Cisco Linksys Remote Preauth 0day Root Exploit Follow-Up

A few weeks ago, we have announced remote preauth root access exploit for Cisco Linksys http://www.youtube.com/watch?v=cv-MbL7KFKE. Vulnerability details were disclosed here: http://www.defensecode.com/public/DefenseCodeBroadcomSecurityAdvisory.pdf During further research, we have discovered that...

Remote Root access vulnerability in Routers with Broadcom chipsets

DefenseCode researchers have discovered a critical security vulnerability that allows remote unauthenticated attacker to remotely execute arbitrary code under root privileges in the UPnP Universal Plug and Play implementation developed by Broadcom and used by many routers with Broadcom chipsets...

Broadcom BCM4325 BCM4329 Devices - Denial of Service

Broadcom BCM4325 BCM4329 Devices - Denial of Service Exploit Author: CoreLabs Core Security Technologies fue descubierta por el investigador argentino Andrés Blanco, Vendor Homepage: Software Link: download link if available Version: 1.0 Tested on: Apple iPhone 3GS Apple iPod 2G HTC Touch Pro 2 H...

CVE-2012-2619

The CVE-2012-2619 entry concerns a flaw in Broadcom BCM4325/ BCM4329 Wi‑Fi firmware that handles 802.11i information elements. An out-of-bounds read could be triggered by a remote attacker on the same Wi‑Fi network, potentially causing a Wi‑Fi outage or device instability. Apple TV advisories cor...

CVE-2012-4924

Buffer overflow in the CxDbgPrint function in the ipswcom.dll ActiveX component 1.0.0.1 for ASUS Net4Switch 1.0.0020 allows remote attackers to execute arbitrary code via a long parameter to the Alert method...