CVE-2018-18291

A cross site scripting XSS vulnerability on ASUS RT-AC58U 3.0.0.4.3806516 devices allows remote attackers to inject arbitrary web script or HTML via AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp, AdvancedWirelessContent.asp, Logout.asp, MainLogin.asp, MobileQISLogin.asp, QISwizard.htm...

CVE-2018-17127

blockingrequest.cgi on ASUS GT-AC5300 devices through 3.0.0.4.38432738 allows remote attackers to cause a denial of service NULL pointer dereference and device crash via a request that lacks a timestap parameter...

ASUS GT-AC5300 Denial of Service Vulnerability (CNVD-2018-19561)

The ASUS GT-AC5300 is a wireless router from ASUS. A security vulnerability exists in the blockingrequest.cgi file in the ASUS GT-AC5300 3.0.0.4.38432738 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of service null pointer backreference and device crash...

CVE-2018-17023

Cross-site request forgery CSRF vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.38432738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to startapply.htm...

CVE-2018-17022

Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.38432738 allows remote attackers to cause a denial of service device crash or possibly have unspecified other impact by setting a long shpath0 value and then sending an appGet.cgi?hook=selectlist"StoragexSharedPath" request,...

CVE-2018-17022

Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.38432738 allows remote attackers to cause a denial of service device crash or possibly have unspecified other impact by setting a long shpath0 value and then sending an appGet.cgi?hook=selectlist"StoragexSharedPath" request,...

ASUS DSL-N12E_C1 Remote Command Execution Vulnerability

ASUS DSL-N12EC1 is a wireless router product from ASUS. A remote command execution vulnerability exists in the MainAnalysisContent.asp file in the ASUS DSL-N12EC1 version 1.1.2.3345. A remote attacker can exploit this vulnerability to execute arbitrary operating system commands with the help of...

CVE-2018-15887

MainAnalysisContent.asp in ASUS DSL-N12EC1 1.1.2.3345 is prone to Authenticated Remote Command Execution, which allows a remote attacker to execute arbitrary OS commands via service parameters, such as shell metacharacters in the destIP parameter of a cmdMethod=ping request...

ASUS RT-AC1200HP Cross-Site Scripting Vulnerability

ASUS RT-AC1200HP is a wireless router product from ASUS. A cross-site scripting vulnerability exists in the ASUS RT-AC1200HP using firmware versions prior to 3.0.0.4.380.4180. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

ASUS RT-AC68U Cross-Site Scripting Vulnerability (CNVD-2018-09580)

ASUS RT-AC68U is an enterprise-class wireless router product from ASUS. A cross-site scripting vulnerability exists in the ASUS RT-AC68U using firmware versions prior to 3.0.0.4.378.9383. A remote attacker can exploit the vulnerability to inject arbitrary web script or HTML...

CVE-2018-0583

Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0581

Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

RT-AC68U vulnerable to cross-site scripting

Overview RT-AC68U provided by ASUS Japan Inc. is a wireless LAN router. RT-AC68U contains a cross-site scripting vulnerability CWE-79. Yuto MAEDA of University of Tsukuba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

RT-AC87U vulnerable to cross-site scripting

Overview RT-AC87U provided by ASUS Japan Inc. is a wireless LAN router. RT-AC87U contains a cross-site scripting vulnerability CWE-79. Keigo Yamazaki of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

ASUS RT-N14UHP 'flag' parameter cross-site scripting vulnerability

The ASUS RT-N14UHP is a wireless router device from ASUS. A cross-site scripting vulnerability exists in the 'flag' parameter in ASUS RT-N14UHP devices prior to version 3.0.0.4.380.8015. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2017-15656

Password are stored in plaintext in nvram in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt...

CVE-2017-15655

Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version =3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time...

ASUS DSL-N14U B1 Router 1.1.2.3_345 - Change Administrator Password Exploit

Exploit for hardware platform in category web applications import requests import sys import urllib3 ip = sys.argv1 user = sys.argv2 newPassword = sys.argv3 requests.packages.urilib3.disablewarnings urllib3.disablewarningsurllib3.exceptions.InsecureRequestWarning data = "groupid": '', "actionmode...

ASUS DSL-N14U B1 Router 1.1.2.3_345 - Change Administrator Password

ASUS DSL-N14U B1 Router 1.1.2.3345 - Change Administrator Password import requests import sys import urllib3 ip = sys.argv1 user = sys.argv2 newPassword = sys.argv3 requests.packages.urilib3.disablewarnings urllib3.disablewarningsurllib3.exceptions.InsecureRequestWarning data = "groupid": '',...

Multiple ASUS Products Asuswrt-Merlin httpd Stack Buffer Overflow Vulnerability

ASUS RT-AC5300 and others are wireless routers from Asus ASUS. asus Asuswrt-Merlin is the firmware that runs in it. httpd is one of the embedded http servers. A stack buffer overflow vulnerability exists in Asuswrt-Merlin 380.670RT-AC5300 and prior versions of httpd in several ASUS products. A...