CVE-2018-17022

Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.38432738 allows remote attackers to cause a denial of service device crash or possibly have unspecified other impact by setting a long shpath0 value and then sending an appGet.cgi?hook=selectlist"StoragexSharedPath" request,...

CVE-2018-17020

ASUS GT-AC5300 devices with firmware through 3.0.0.4.38432738 allow remote attackers to cause a denial of service via a single "GET / HTTP/1.1\r\n" line...

CVE-2018-17021

Cross-site scripting XSS vulnerability on ASUS GT-AC5300 devices with firmware through 3.0.0.4.38432738 allows remote attackers to inject arbitrary web script or HTML via the appGet.cgi hook parameter...

CVE-2018-17020

CVE-2018-17020 affects ASUS GT-AC5300 devices with firmware up to 3.0.0.4.384_32738. The issue allows remote attackers to cause a denial of service by sending a single HTTP request line (GET / HTTP/1.1). Connected documents confirm the vendor/product and the repro vector, and describe the impact ...

CVE-2018-17022

CVE-2018-17022 affects ASUS GT-AC5300 routers (firmware 3.0.0.4.384_32738 and earlier). The issue is a stack-based buffer overflow in ej_select_list used by the web CGI code, triggered by sending a long sh_path0 value in a request to appGet.cgi?hook=select_list("Storage_x_SharedPath"), where strc...

CVE-2018-17023

Summary (CVE-2018-17023) The issue affects the ASUS GT-AC5300 router family, with firmware up to 3.0.0.4.384_32738. A cross-site request forgery (CSRF) vulnerability could allow an attacker to hijack administrator authentication and perform password-change actions via a request to start_apply.htm...

CVE-2018-17020

ASUS GT-AC5300 devices with firmware through 3.0.0.4.38432738 allow remote attackers to cause a denial of service via a single "GET / HTTP/1.1\r\n" line...

CVE-2018-17021

Summary: CVE-2018-17021 is an XSS vulnerability affecting ASUS GT-AC5300 routers (firmware up to 3.0.0.4.384_32738). The flaw allows a remote attacker to inject arbitrary web script or HTML via the appGet.cgi hook parameter. Affected software/entry details (from connected docs): ASUS GT-AC5300 ro...

CVE-2018-17021: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on ASUS GT-AC5300 devices with firmware through 3.0.0.4.38432738 allows remote attackers to inject arbitrary web script or HTML via the appGet.cgi hook parameter...

PT-2018-13843

Name of the Vulnerable Software and Affected Versions ASUS GT-AC5300 router versions through 3.0.0.4.384 32738 Description A stack-based buffer overflow issue allows remote attackers to cause a denial of service device crash or possibly have other unspecified impacts. This is achieved by setting ...

PT-2018-13841

Name of the Vulnerable Software and Affected Versions ASUS GT-AC5300 devices with firmware through 3.0.0.4.384 32738 Description The issue allows remote attackers to cause a denial of service. This can be achieved by sending a single "GET / HTTP/1.1r " line to the API endpoint "GET /". No...

PT-2018-13842

Name of the Vulnerable Software and Affected Versions ASUS GT-AC5300 devices with firmware through 3.0.0.4.384 32738 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the appGet.cgi hook parameter. This could potentially lead to...

CVE-2018-17022: Out-of-bounds Write

Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.38432738 allows remote attackers to cause a denial of service device crash or possibly have unspecified other impact by setting a long shpath0 value and then sending an appGet.cgi?hook=selectlist"StoragexSharedPath" request,...

CVE-2018-17020: Undefined Security Weakness

ASUS GT-AC5300 devices with firmware through 3.0.0.4.38432738 allow remote attackers to cause a denial of service via a single "GET / HTTP/1.1\r\n" line...

PT-2018-13844

Name of the Vulnerable Software and Affected Versions ASUS GT-AC5300 routers with firmware through 3.0.0.4.384 32738 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a...

CVE-2018-17023: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.38432738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to startapply.htm...

Asus_DeleteOfflineClientOverflow

Vulnerability: Stack buffer overflow in httpd ------------------------------------------ Exploitation: Can control the $pc. Use together with a session hijack vulnerability or in a csrf attack, can remote code execution and then get a connectback shell. ------------------------------------------...

PT-2017-3654

Name of the Vulnerable Software and Affected Versions: ASUS RT-AC66U versions prior to 3.0.0.4.384 10007 ASUS RT-AC68U versions prior to 3.0.0.4.384 10007 ASUS RT-AC86U versions prior to 3.0.0.4.384 10007 ASUS RT-AC88U versions prior to 3.0.0.4.384 10007 ASUS RT-AC1900 versions prior to 3.0.0.4.3...

Networkmap Buffer Overflow Vulnerability in Multiple ASUS Products

ASUS RT-AC5300 and others are wireless routers from ASUS. networkmap is one of the network diagram components. A buffer overflow vulnerability exists in networkmap in several ASUS products. A remote attacker can exploit this vulnerability to execute arbitrary code on the router...

Multiple ASUS Products Asuswrt-Merlin httpd Stack Buffer Overflow Vulnerability

ASUS RT-AC5300 and others are wireless routers from Asus ASUS. asus Asuswrt-Merlin is the firmware that runs in it. httpd is one of the embedded http servers. A stack buffer overflow vulnerability exists in Asuswrt-Merlin 380.670RT-AC5300 and prior versions of httpd in several ASUS products. A...