21 matches found
ASUS infosvr - Authentication Bypass Command Execution (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ASUS infosvr Auth Bypass Command Execution', 'Description' = %q This module exploits an authentication bypass vulnerability in the infosvr service...
ASUS infosvr Authentication Bypass Command Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ASUS infosvr Auth Bypass Command Execution', 'Description' = %q This module exploits an authentication bypass vulnerability in the infosvr service...
AsusWRT LAN Unauthenticated Remote Code Execution Exploit
The HTTP server in AsusWRT has a flaw where it allows an unauthenticated client to perform a POST in certain cases. This can be combined with another vulnerability in the VPN configuration upload routine that sets NVRAM configuration variables directly from the POST request to enable a special...
ASUS infosvr Auth Bypass Command Execution
This module exploits an authentication bypass vulnerability in the infosvr service running on UDP port 9999 on various ASUS routers to execute arbitrary commands as root. This module launches the BusyBox Telnet daemon on the port specified in the TelnetPort option to gain an interactive remote...
Asus Unauthenticated LAN Remote Command Execution Exploit
Exploit for hardware platform in category remote exploits Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE...
ASUSWRT Device Unauthenticated Modified Configuration Vulnerability
ASUS AsusWRT is a set of router operating systems from ASUS. A security vulnerability exists in the 'dovpnuploadpost' function in the router/httpd/web.c file of the vpnupload.cgi file in versions prior to ASUS AsusWRT 3.0.0.4.38410007. An attacker can exploit this vulnerability by sending a...
Asus Unauthenticated LAN Remote Command Execution
Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT...
CVE-2018-6000
An issue was discovered in AsusWRT before 3.0.0.4.38410007. The dovpnuploadpost function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon or enable infosvr command mode,...
AsusWRT LAN Unauthenticated Remote Code Execution
The HTTP server in AsusWRT has a flaw where it allows an unauthenticated client to perform a POST in certain cases. This can be combined with another vulnerability in the VPN configuration upload routine that sets NVRAM configuration variables directly from the POST request to enable a special...
ASUSWRT 3.0.0.4.376_1071 - LAN Backdoor Command Execution
漏洞概要2014年10月3日，国外安全研究员Joshua J. Drake在他github（https://github.com/jduck）提交了针对华硕路由器的一个远程命令执行漏洞poc（https://github.com/jduck/asus-cmd）。该漏洞随后被编号为CVE-2014-9583。知道创宇安全研究团队在第一时间对该命令执行漏洞进行了研究和分析。a 漏洞描述华硕路由器R系列路由器使用开源路由器系统 Asuswrt，开源代码给我们随后的漏洞分析带来很多方便，不用逆向分析。在Asuswrt中存在 infosvr 进程，该进程监听在0.0.0.0...
ASUS Router 'infosvr' Remote Command Execution
The remote device is an ASUS router that contains firmware which is affected by a flaw in its 'infosvr' service due to not properly checking the MAC address of a request. An unauthenticated, remote attacker, using a crafted request to UDP port 9999, can exploit this to run arbitrary commands or...
ASUS router exposure remote command execution vulnerability-vulnerability warning-the black bar safety net
The ASUS router firmware is detected a serious vulnerability that can be made without the authentication of an attacker in the router to remotely execute any command that could affect the ASUS all versions of the router firmware. Security researcher Joshua Drake in several ASUS router firmware...
ASUS Router infosvr Service Remote Command Execution Vulnerability
Added: 01/13/2015 CVE: CVE-2014-9583 BID: 71889 OSVDB: 116691 Background ASUS manufactures network devices, including routers and wireless repeaters. Some of these devices include the infosvr service, part of the "ASUS Wireless Router Device Discovery Utility". The infosvr service listens on port...
ASUS Router infosvr Service Remote Command Execution Vulnerability
Added: 01/13/2015 CVE: CVE-2014-9583 BID: 71889 OSVDB: 116691 Background ASUS manufactures network devices, including routers and wireless repeaters. Some of these devices include the infosvr service, part of the "ASUS Wireless Router Device Discovery Utility". The infosvr service listens on port...
ASUS Router infosvr Service Remote Command Execution Vulnerability
Added: 01/13/2015 CVE: CVE-2014-9583 BID: 71889 OSVDB: 116691 Background ASUS manufactures network devices, including routers and wireless repeaters. Some of these devices include the infosvr service, part of the "ASUS Wireless Router Device Discovery Utility". The infosvr service listens on port...
ASUS router aeration Root privileges command execution vulnerability-vulnerability warning-the black bar safety net
! 2 copya foreign security researchers the 6th of this month in the online disclosure, the ASUS router firmware there is a serious vulnerability that allows the execution of unauthorized commands, and may exist in all current versions of ASUS router firmware. Currently, there is already an exploi...
ASUS Router infosvr Service Remote Command Execution Vulnerability
Added: 01/13/2015 CVE: CVE-2014-9583 BID: 71889 OSVDB: 116691 Background ASUS manufactures network devices, including routers and wireless repeaters. Some of these devices include the infosvr service, part of the "ASUS Wireless Router Device Discovery Utility". The infosvr service listens on port...
CVE-2014-9583
common.c in infosvr in ASUS WRT firmware 3.0.0.4.3761071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via ...
Root Command Execution Flaw Haunts ASUS Routers
There is a serious security vulnerability in the firmware of many ASUS routers that allows unauthenticated command execution. The bug may be present in all current versions of the router firmware, and there is an exploit published for it, as well. Security researchers Joshua Drake posted an...
ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution
!/usr/bin/env python3 Exploit Title: ASUSWRT 3.0.0.4.3761071 LAN Backdoor Command Execution Date: 2014-10-11 Vendor Homepage: http://www.asus.com/ Software Link: http://dlcdnet.asus.com/pub/ASUS/wireless/RT-N66UB1/FWRTN66U30043762524.zip Source code:...