CVE-2017-15654

Highly predictable session tokens in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt allow gaining administrative router access...

Design/Logic Flaw

Highly predictable session tokens in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt allow gaining administrative router access...

CVE-2017-15654

Highly predictable session tokens in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt allow gaining administrative router access...

Design/Logic Flaw

Password are stored in plaintext in nvram in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt...

CVE-2017-15653

Improper administrator IP validation after his login in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt allows an unauthorized user to execute any action knowing administrator session token by using a specific User-Agent string...

CVE-2017-15655

Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version =3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time...

CVE-2017-15655

CVE-2017-15655 affects the AsusWRT HTTPd server in Asus routers with firmware versions up to 3.0.0.4.376.X. The vulnerability is a buffer overflow in the HTTPd service that can lead to remote code execution with administrator privileges when an administrator visits certain pages. All vulnerable i...

CVE-2017-15656

Password are stored in plaintext in nvram in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt...

CVE-2017-15653

CVE-2017-15653 concerns AsusWRT routers with the HTTPd web interface. It describes an improper administrator IP validation after login, allowing an unauthorized user who has a valid administrator session token to perform any action by sending a crafted User-Agent string. Affected versions are all...

CVE-2017-15655

Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version =3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time...

CVE-2017-15653

Improper administrator IP validation after his login in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt allows an unauthorized user to execute any action knowing administrator session token by using a specific User-Agent string...

CVE-2017-15654

CVE-2017-15654 affects AsusWRT's HTTPd in Asus routers (versions up to 3.0.0.4.380.7743). The vulnerability stems from highly predictable session tokens generated by reseeding the RNG with time(), enabling an attacker to infer or guess a valid administrator session and gain router admin access. C...

CVE-2017-15654

Highly predictable session tokens in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt allow gaining administrative router access...

CVE-2017-15656

CVE-2017-15656 is confirmed to affect AsusWRT firmware with the httpd nvram storage path. Multiple connected sources state plaintext passwords are stored in nvram and thus readable without proper protection in versions up to 3.0.0.4.380.7743 (and earlier per CNVD), enabling an attacker with acces...

AsusWRT Router Remote Code Execution

Unauthenticated LAN remote code execution in AsusWRT Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last updated: 25/01/2018 Background and summary AsusWRT is the...

Asus Unauthenticated LAN Remote Command Execution Exploit

Exploit for hardware platform in category remote exploits Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE...

ASUSWRT Device Unauthenticated Modified Configuration Vulnerability

ASUS AsusWRT is a set of router operating systems from ASUS. A security vulnerability exists in the 'dovpnuploadpost' function in the router/httpd/web.c file of the vpnupload.cgi file in versions prior to ASUS AsusWRT 3.0.0.4.38410007. An attacker can exploit this vulnerability by sending a...

AsusWRT router/httpd/httpd.c file access bypass vulnerability

ASUS AsusWRT is a set of router operating systems from ASUS. A security vulnerability exists in the 'handlerequest' function of the router/httpd/httpd.c file in versions prior to ASUS AsusWRT 3.0.0.4.38410007. An attacker can exploit this vulnerability to execute a POST request...

Asus Unauthenticated LAN Remote Command Execution

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT...

Authentication flaw

An issue was discovered in AsusWRT before 3.0.0.4.38410007. In the handlerequest function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails...