Code injection

An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.38520253. The router accepts an arbitrary server certificate for a firmware update. The culprit is the --no-check-certificate option passed to wget tool used to download firmware update files...

CVE-2020-15498

CVE-2020-15498 affects ASUS RT-AC1900P routers prior to 3.0.0.4.385_20253. The vulnerability stems from the firmware update mechanism accepting unvalidated server certificates due to the use of wget with the --no-check-certificate option. This enables potential man-in-the-middle scenarios during ...

CVE-2020-15498

An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.38520253. The router accepts an arbitrary server certificate for a firmware update. The culprit is the --no-check-certificate option passed to wget tool used to download firmware update files...

CVE-2020-15499

An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.38520253. They allow XSS via spoofed Release Notes on the Firmware Upgrade page...

CVE-2020-15499

The CVE-2020-15499 issue affects ASUS RT-AC1900P routers. A cross-site scripting vulnerability exists in the Firmware Upgrade page’s release notes rendering, enabling injected script when a malicious actor can influence the page (e.g., via a MITM scenario with spoofed release notes). Affected fir...

asus-accessories.com Cross Site Scripting vulnerability OBB-1270269

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

asusmobile.ru Cross Site Scripting vulnerability OBB-1238059

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

ASUS Home Router Bugs Open Consumers to Snooping Attacks

A pair of flaws in ASUS routers for the home could allow an attacker to compromise the devices – and eavesdrop on all of the traffic and data that flows through them. The bugs are specifically found in the RT-AC1900P whole-home Wi-Fi model, within the router’s firmware update functionality...

asusmobile.ru Cross Site Scripting vulnerability OBB-1235156

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

ASUS ScreenPad2 Upgrade Tool Code Issue Vulnerability

ASUS ScreenPad2 Upgrade Tool is an update tool for the ASUS ScreenPad2 touchpad from ASUS of Taiwan, China.ASUS ScreenPad2 Upgrade Tool version 1.0.3 contains the AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe files are vulnerable to a code issue. An attacker could exploit t...

CVE-2020-15009

AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2UpgradeTool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 UX450FDX, UX550GDX and UX550GEX could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with ...

CVE-2020-15009

AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2UpgradeTool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 UX450FDX, UX550GDX and UX550GEX could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with ...

CVE-2020-15009

AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2UpgradeTool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 UX450FDX, UX550GDX and UX550GEX could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with ...

Code injection

AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2UpgradeTool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 UX450FDX, UX550GDX and UX550GEX could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with ...

CVE-2020-15009

ASUS ScreenPad2 Upgrade Tool (ScreenPad1.0) — The CVE affects ScreenPad2_Upgrade_Tool.msi v1.0.3 on AXUX UX450FDX, UX550GDX, UX550GEX. Two executables, AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe, are implicated. The issue permits unsigned code execution with no additiona...

CVE-2020-15009

AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2UpgradeTool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 UX450FDX, UX550GDX and UX550GEX could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with ...

Report: Most Popular Home Routers Have ‘Critical’ Flaws

A security review of 127 popular home routers found most contained at least one critical security flaw, according to researchers. The “Home Router Security Report” PDF by Peter Weidenbach and Johannes vom Dorp—both from the German think tank Fraunhofer Institute–found that not only did all of the...

ASUS Aura Sync 1.07.71 CVE-2019-17603 - Privilege Escalation

ASUS Aura Sync version 1.07.71 ene.sys privilege escalation kernel exploit. // CVE-2019-17603: ASUS Aura Sync 1.07.71 'ene.sys' EoP Kernel Exploit // Discovered by @dhn // Author of PoC: Connor McGarr @33y0re - https://connormcgarr.github.io // Windows 10 RS1 Version 10.0.14393 Build 14393 //...

ASUS Aura Sync 1.07.71 Privilege Escalation Exploit

// CVE-2019-17603: ASUS Aura Sync 1.07.71 'ene.sys' EoP Kernel Exploit // Discovered by @dhn // Author of PoC: Connor McGarr @33y0re - https://connormcgarr.github.io // Windows 10 RS1 Version 10.0.14393 Build 14393 // Tested with VBS, HyperGuard, and PatchGuard disabled include include include //...

Asus GT-AC5300 Stack Buffer Overflow (CVE-2018-17022)

A Buffer overflow vulnerability exists in Asus GT-AC5300. Successful exploitation of this vulnerability could result in a denial of service condition...