PT-2025-17288

Name of the Vulnerable Software and Affected Versions ASUS AiCloud affected versions not specified Description A critical authentication control issue exists in ASUS AiCloud, potentially allowing attackers to bypass authentication and execute unauthorized functions on affected devices remotely. T...

ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE)

Exploit Title: ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution RCE Date: 2023-02-16 Exploit Author: [email protected] for NetworkSEC NWSSA-002-2023, SC Vendor Homepage: https://servers.asus.com/search?q=ASMB8 Version/Model: ASMB8 iKVM Firmware = 1.14.51 probably others Tested on: Linux...

PT-2025-20479

Name of the Vulnerable Software and Affected Versions ASUS DriverHub versions prior to 1.0.6.0 Description An insufficient validation issue exists in ASUS DriverHub. This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints. The issue may allow...

PT-2025-20478

Name of the Vulnerable Software and Affected Versions ASUS DriverHub versions prior to 1.0.6.0 Description The issue resides in the data source validation mechanism within ASUS DriverHub. Insufficient validation allows unauthorized sources to interact with the software's features through crafted...

CVE-2025-2027

A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC requests, leading to the service crash and potentially memory manipulation in some rare circumstances. Refer to the 'Security Update for...

CVE-2025-2027

A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC requests, leading to the service crash and potentially memory manipulation in some rare circumstances. Refer to the 'Security Update for...

CVE-2025-2027

A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC requests, leading to the service crash and potentially memory manipulation in some rare circumstances. Refer to the 'Security Update for...

CVE-2025-2027

The CVE-2025-2027 entry describes a double-free vulnerability in the ASUS System Analysis service triggered by specially crafted local RPC requests, potentially causing a service crash and, in rare cases, memory manipulation. Affected component is the local RPC handling within the ASUS System Ana...

CVE-2025-2027

A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC requests, leading to the service crash and potentially memory manipulation in some rare circumstances. Refer to the 'Security Update for...

ASUS System Control Interface 安全漏洞

ASUS System Control Interface is a computer system control interface from Asus China. A security vulnerability exists in ASUS System Control Interface that originates from a double release triggered when sending a specially crafted local RPC request, which could lead to a service crash and memory...

The vulnerability in the sysinfo.asp script of ASUS RT-N12E router microprogramming software allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the sysinfo.asp script in ASUS RT-N12E router microprogramming software is related to the lack of measures taken to protect the website structure when processing SSID identifiers. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks X...

ASUS RT-N12E Cross-Site Scripting Vulnerability

The ASUS RT-N12E is a wireless router from the Chinese company ASUS. A cross-site scripting vulnerability exists in ASUS RT-N12E version 2.0.0.19, which stems from the lack of effective filtering and escaping of user-supplied data in the SSID parameter of the sysinfo.asp file, which can be...

CVE-2025-1354

A cross-site scripting XSS vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of...

CVE-2025-1354

A cross-site scripting XSS vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of...

CVE-2025-1354

A cross-site scripting XSS vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of...

CVE-2025-1354

CVE-2025-1354 affects Asus RT-N10E/RT-N12E devices running firmware 2.0.0.x. It is a reflected XSS vulnerability triggered by manipulating the SSID parameter in sysinfo.asp, due to improper input validation. This can lead to disclosure of sensitive information. All RT-N10E/RT-N12E versions are EO...

ASUS RT-N12E 代码注入漏洞

The ASUS RT-N12E is a wireless router from the Chinese company ASUS. A cross-site scripting vulnerability exists in ASUS RT-N12E version 2.0.0.19, which stems from the lack of effective filtering and escaping of user-supplied data in the SSID parameter of the sysinfo.asp file, which can be...

CVE-2024-33221

An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests...

CVE-2024-33218

An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests...

CVE-2024-33219

An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests...