CVE-2023-39239 ASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2

It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary...

CVE-2023-39239

The CVE-2023-39239 entry concerns an authenticated/remote (sources vary on privilege) format string vulnerability in the General function API (apply.cgi) of ASUS RT-AX56U V2. The flaw arises from lack of input validation for a specific value in apply.cgi, enabling remote code execution or disrupt...

CVE-2023-39236

ASUS RT-AC86U Traffic Analyzer - Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

Command injection

ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

Command injection

ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-39237 ASUS RT-AC86U - Command injection vulnerability - 5

ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-39236

ASUS RT-AC86U Traffic Analyzer - Statistic function is vulnerable to command injection due to insufficient filtering of special characters. A remote attacker with regular user privileges can trigger arbitrary command execution, potentially corrupting the system or stopping services. Affected prod...

CVE-2023-38033 ASUS RT-AC86U - Command injection vulnerability - 3

ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-38033 ASUS RT-AC86U - Command injection vulnerability - 3

ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-38032 ASUS RT-AC86U - Command injection vulnerability - 2

ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-38032

CVE-2023-38032 affects the ASUS RT-AC86U router’s AiProtection security-related function. The root cause is insufficient filtering of special characters, enabling a remote attacker with regular user privileges to perform a command injection and execute arbitrary commands, potentially disrupting t...

CVE-2023-38031

ASUS RT-AC86U Adaptive QoS - Web History function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

Potential Out of Bound Error When Accessing Range Array

Lines of code Vulnerability details The code seems to be attempting to access an element of the 'ranges' array using an index calculated from the array's length minus one. However, during the deployment or initialization of the contract, if the length of 'ranges' is 1, this calculation results in...

The vulnerability of the TIFFReadDirectory function in the LibTIFF library, which allows a hacker to cause a service failure.

The vulnerability of the TIFFReadDirectory function in the LibTIFF library is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Malicious users can manipulate the withdrawRound to withdraw their stake before the unbonding period is over.

Lines of code Vulnerability details Impact Disruption the normal bonding incentives and mechanisms in the protocol. Validators or transcoders could withdrew unexpectedly, preventing governance responses to bonded token changes. Proof of Concept The withdrawStake function first checks if the...

The vulnerability of the formSetDeviceName() function in the Tenda AC8 router’s microprogramming software allows a hacker to execute arbitrary code, increase their privileges, or cause service failures.

The vulnerability of the formSetDeviceName function in the Tenda AC8 router’s microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, gain elevated privileges, or cause...

Vulnerability of the gdi_CreateSurface() function in RDP clients of FreeRDP, allowing attackers to cause service interruptions

The vulnerability of the gdiCreateSurface function in the RDP client FreeRDP is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2023-7491 · Asus · Asus Rt-Ac86U

Name of the Vulnerable Software and Affected Versions: ASUS RT-AC86U affected versions not specified Description: The issue exists due to insufficient filtering of special characters in the Traffic Analyzer - Statistic function of the ASUS RT-AC86U Wi-Fi router's firmware. A remote attacker with...

Vulnerability of the progressive_decompress() function in the RDP client FreeRDP, allowing a hacker to trigger a service failure

The vulnerability of the progressivedecompress function in the RDP client FreeRDP is related to the occurrence of operations outside the buffer in memory when processing nXSrc and nYSrc. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the GetParentControlInfo() function in Tenda AC9 and Tenda AC5 router microprogramming software allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the GetParentControlInfo function in Tenda AC9 and Tenda AC5 routers is related to the issue where an operation exceeds the buffer boundaries in memory when processing the mac parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause...