Search
Find a vulnerability
Search criteria
28 vulnerabilities found for rt-ax55_firmware by asus
CVE-2023-41348 (GCVE-0-2023-41348)
Vulnerability from nvd – Published: 2023-11-03 04:32 – Updated: 2024-09-06 18:34
VLAI
Title
ASUS RT-AX55 - command injection - 4
Summary
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386.51598
|
|
| asus | rt-ax55_firmware |
Affected:
3.0.0.4.386.51598
cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
Date Public
2023-11-03 06:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:34.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7499-63907-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55_firmware",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-05T15:47:46.461984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T18:34:47.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"datePublic": "2023-11-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-03T07:16:13.129Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7499-63907-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\nUpdate version to 3.0.0.4.386_51948 .\u003cbr\u003e"
}
],
"value": "\n\n\n\n\nUpdate version to 3.0.0.4.386_51948 .\n"
}
],
"source": {
"advisory": "TVN-202311005",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55 - command injection - 4",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-41348",
"datePublished": "2023-11-03T04:32:01.829Z",
"dateReserved": "2023-08-29T00:11:47.812Z",
"dateUpdated": "2024-09-06T18:34:47.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41347 (GCVE-0-2023-41347)
Vulnerability from nvd – Published: 2023-11-03 04:29 – Updated: 2024-09-04 20:21
VLAI
Title
ASUS RT-AX55 - command injection - 3
Summary
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386.51598
|
|
| asus | rt-ax55_firmware |
Affected:
3.0.0.4.386.51598
cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
Date Public
2023-11-03 06:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:35.328Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7498-18012-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55_firmware",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41347",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-04T20:17:23.869793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-04T20:21:02.091Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"datePublic": "2023-11-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-03T07:15:54.767Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7498-18012-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\nUpdate version to 3.0.0.4.386_51948 .\u003cbr\u003e"
}
],
"value": "\n\n\nUpdate version to 3.0.0.4.386_51948 .\n"
}
],
"source": {
"advisory": "TVN-202311004",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55 - command injection - 3",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-41347",
"datePublished": "2023-11-03T04:29:39.109Z",
"dateReserved": "2023-08-29T00:11:47.812Z",
"dateUpdated": "2024-09-04T20:21:02.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41346 (GCVE-0-2023-41346)
Vulnerability from nvd – Published: 2023-11-03 04:21 – Updated: 2024-09-06 18:35
VLAI
Title
ASUS RT-AX55 - command injection - 2
Summary
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386.51598
|
|
| asus | rt-ax55_firmware |
Affected:
3.0.0.4.386.51598
cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
Date Public
2023-11-03 06:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:34.461Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7497-f92ac-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55_firmware",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41346",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-05T15:51:29.591472Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T18:35:57.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"datePublic": "2023-11-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-03T07:15:22.787Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7497-f92ac-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nUpdate version to 3.0.0.4.386_51948 .\n\n\u003cbr\u003e"
}
],
"value": "\nUpdate version to 3.0.0.4.386_51948 .\n\n\n"
}
],
"source": {
"advisory": "TVN-202311003",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55 - command injection - 2",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-41346",
"datePublished": "2023-11-03T04:21:26.406Z",
"dateReserved": "2023-08-29T00:11:47.812Z",
"dateUpdated": "2024-09-06T18:35:57.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41345 (GCVE-0-2023-41345)
Vulnerability from nvd – Published: 2023-11-03 04:16 – Updated: 2024-09-06 18:37
VLAI
Title
ASUS RT-AX55 - command injection - 1
Summary
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386.51598
|
|
| asus | rt-ax55_firmware |
Affected:
3.0.0.4.386.51598
cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
Date Public
2023-11-03 06:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:34.254Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7496-96e2c-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55_firmware",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-05T17:59:46.132221Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T18:37:02.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"datePublic": "2023-11-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services."
}
],
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-03T07:14:55.631Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7496-96e2c-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update version to\u0026nbsp;3.0.0.4.386_51948 ."
}
],
"value": "Update version to\u00a03.0.0.4.386_51948 ."
}
],
"source": {
"advisory": "TVN-202311002",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55 - command injection - 1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-41345",
"datePublished": "2023-11-03T04:16:47.501Z",
"dateReserved": "2023-08-29T00:11:47.812Z",
"dateUpdated": "2024-09-06T18:37:02.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39780 (GCVE-0-2023-39780)
Vulnerability from nvd – Published: 2023-09-11 00:00 – Updated: 2025-10-21 23:05Summary
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
Severity
8.8 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
8 references
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:18:09.983Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39780",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-06T03:55:31.213801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-06-02",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-39780"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:05:39.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"url": "https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-39780"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-06-02T00:00:00.000Z",
"value": "CVE-2023-39780 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar \"token-generated module\" issue, see CVE-2023-41345; for the similar \"token-refresh module\" issue, see CVE-2023-41346; for the similar \"check token module\" issue, see CVE-2023-41347; and for the similar \"code-authentication module\" issue, see CVE-2023-41348."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-16T16:02:57.679Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-39780",
"datePublished": "2023-09-11T00:00:00.000Z",
"dateReserved": "2023-08-07T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:05:39.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39240 (GCVE-0-2023-39240)
Vulnerability from nvd – Published: 2023-09-07 07:25 – Updated: 2024-09-26 19:19
VLAI
Title
ASUS RT-AX55、RT-AX56U_V2 - Format String - 3
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AX56U_V2 |
Affected:
3.0.0.4.386_50460
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386.50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ax55 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:* |
Date Public
2023-09-15 01:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.659Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7356-021bf-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T19:18:03.026290Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T19:19:30.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AX56U_V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"datePublic": "2023-09-15T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:02:04.782Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7356-021bf-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\u003cp\u003eRT-AX55: update to 3.0.0.4.386_51948 \u003c/p\u003e\u003cp\u003eRT-AX56U_V2: update to 3.0.0.4.386_51948 \u003cbr\u003e\u003c/p\u003e"
}
],
"value": "\nRT-AX55: update to 3.0.0.4.386_51948 \n\nRT-AX56U_V2: update to 3.0.0.4.386_51948 \n\n"
}
],
"source": {
"advisory": "TVN-202309009",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55\u3001RT-AX56U_V2 - Format String - 3",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-39240",
"datePublished": "2023-09-07T07:25:32.504Z",
"dateReserved": "2023-07-26T00:58:24.845Z",
"dateUpdated": "2024-09-26T19:19:30.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39239 (GCVE-0-2023-39239)
Vulnerability from nvd – Published: 2023-09-07 07:18 – Updated: 2024-09-26 18:56
VLAI
Title
ASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AX56U_V2 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AC86U |
Affected:
3.0.0.4_386_51529
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ax55 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:* |
|
| asus | rt-ac86u |
Affected:
3.0.0.4_386_51529
cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:* |
Date Public
2023-09-15 01:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.688Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ac86u",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T18:53:39.966621Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T18:56:33.349Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AX56U_V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AC86U",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"datePublic": "2023-09-15T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n\u003cbr\u003e\n\n"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:14:38.193Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eRT-AX55: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AX56U_V2: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AC86U: update to 3.0.0.4.386_51915\u003c/p\u003e"
}
],
"value": "\nRT-AX55: update to 3.0.0.4.386_51948\u00a0\n\nRT-AX56U_V2: update to 3.0.0.4.386_51948\u00a0\n\nRT-AC86U: update to 3.0.0.4.386_51915\n\n"
}
],
"source": {
"advisory": "TVN-202309008",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55\u3001RT-AX56U_V2\u3001RT-AC86U - Format String - 2",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-39239",
"datePublished": "2023-09-07T07:18:39.017Z",
"dateReserved": "2023-07-26T00:58:24.844Z",
"dateUpdated": "2024-09-26T18:56:33.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39238 (GCVE-0-2023-39238)
Vulnerability from nvd – Published: 2023-09-07 07:10 – Updated: 2024-09-26 18:58
VLAI
Title
ASUS RT-AX55、RT-AX56U_V2 - Format String - 1
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AX56U_V2 |
Affected:
3.0.0.4.386_50460
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ax55 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:* |
Date Public
2023-09-15 01:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7354-4e654-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T18:57:07.141155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T18:58:30.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AX56U_V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"datePublic": "2023-09-15T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nIt is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value\u0026nbsp;within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value\u00a0within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:06:35.024Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7354-4e654-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eRT-AX55: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AX56U_V2: update to 3.0.0.4.386_51948\u0026nbsp;\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "\nRT-AX55: update to 3.0.0.4.386_51948\u00a0\n\nRT-AX56U_V2: update to 3.0.0.4.386_51948\u00a0\n\n"
}
],
"source": {
"advisory": "TVN-202309007",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55\u3001RT-AX56U_V2 - Format String - 1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-39238",
"datePublished": "2023-09-07T07:10:47.153Z",
"dateReserved": "2023-07-26T00:58:24.844Z",
"dateUpdated": "2024-09-26T18:58:30.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-26376 (GCVE-0-2022-26376)
Vulnerability from nvd – Published: 2022-08-05 21:18 – Updated: 2025-04-15 18:53
VLAI
Summary
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Asuswrt-Merlin | Asuswrt-Merlin New Gen |
Affected:
prior to 386.7
|
Date Public
2022-07-27 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:03:32.976Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-26376",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-15T18:18:45.679502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T18:53:55.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Asuswrt-Merlin New Gen",
"vendor": "Asuswrt-Merlin",
"versions": [
{
"status": "affected",
"version": "prior to 386.7"
}
]
}
],
"datePublic": "2022-07-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-07T00:00:00.000Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2022-26376",
"datePublished": "2022-08-05T21:18:47.095Z",
"dateReserved": "2022-04-05T00:00:00.000Z",
"dateUpdated": "2025-04-15T18:53:55.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43702 (GCVE-0-2021-43702)
Vulnerability from nvd – Published: 2022-07-05 11:50 – Updated: 2024-08-04 04:03
VLAI
Summary
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.asus.com/uk/Networking-IoT-Servers/Wi… | x_refsource_MISC |
| https://www.kroll.com/en/insights/publications/cy… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:03:08.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-05T11:50:03.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-43702",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/",
"refsource": "MISC",
"url": "https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/"
},
{
"name": "https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch",
"refsource": "MISC",
"url": "https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-43702",
"datePublished": "2022-07-05T11:50:03.000Z",
"dateReserved": "2021-11-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T04:03:08.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41436 (GCVE-0-2021-41436)
Vulnerability from nvd – Published: 2021-11-19 11:14 – Updated: 2024-08-04 03:15
VLAI
Summary
An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://asus.com | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/Whole… | x_refsource_MISC |
| https://rog.asus.com/networking/rog-rapture-gt-ax… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/Whole… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:15:28.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://asus.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-19T11:14:09.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://asus.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-41436",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://asus.com",
"refsource": "MISC",
"url": "http://asus.com"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"name": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios",
"refsource": "MISC",
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-41436",
"datePublished": "2021-11-19T11:14:09.000Z",
"dateReserved": "2021-09-20T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:15:28.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41435 (GCVE-0-2021-41435)
Vulnerability from nvd – Published: 2021-11-19 11:26 – Updated: 2024-08-04 03:15
VLAI
Summary
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://asus.com | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/Whole… | x_refsource_MISC |
| https://rog.asus.com/networking/rog-rapture-gt-ax… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/Whole… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:15:27.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://asus.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-19T11:26:30.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://asus.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-41435",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://asus.com",
"refsource": "MISC",
"url": "http://asus.com"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"name": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios",
"refsource": "MISC",
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-41435",
"datePublished": "2021-11-19T11:26:30.000Z",
"dateReserved": "2021-09-20T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:15:27.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-37910 (GCVE-0-2021-37910)
Vulnerability from nvd – Published: 2021-11-12 01:40 – Updated: 2024-09-16 19:05
VLAI
Title
ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication
Summary
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
Severity
CWE
- CWE-799 - Improper Control of Interaction Frequency
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html | x_refsource_MISC |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | GT-AXE11000 |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
|
| ASUS | RT-AX3000 |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
|
| ASUS | RT-AX55 |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
|
| ASUS | RT-AX58U |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
|
| ASUS | TUF-AX3000 |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
Date Public
2021-11-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:30:09.144Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GT-AXE11000",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "RT-AX3000",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "RT-AX58U",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TUF-AX3000",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-11-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users\u0027 connections by sending specially crafted SAE authentication frames."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "CWE-799 Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-12T01:40:13.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Routes firmware to last version:\nASUS GT-AXE11000 v3.0.0.4.386.45898\nASUS RT-AX3000 v3.0.0.4.386.45898\nASUS RT-AX55 v3.0.0.4.386.45898\nASUS RT-AX58U v3.0.0.4.386.45898\nASUS TUF-AX3000 v3.0.0.4.386.45898"
}
],
"source": {
"advisory": "TVN-202109034",
"discovery": "EXTERNAL"
},
"title": "ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-11-12T07:06:00.000Z",
"ID": "CVE-2021-37910",
"STATE": "PUBLIC",
"TITLE": "ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "GT-AXE11000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
},
{
"product_name": "RT-AX3000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
},
{
"product_name": "RT-AX55",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
},
{
"product_name": "RT-AX58U",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
},
{
"product_name": "TUF-AX3000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
}
]
},
"vendor_name": "ASUS"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users\u0027 connections by sending specially crafted SAE authentication frames."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-799 Improper Control of Interaction Frequency"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Routes firmware to last version:\nASUS GT-AXE11000 v3.0.0.4.386.45898\nASUS RT-AX3000 v3.0.0.4.386.45898\nASUS RT-AX55 v3.0.0.4.386.45898\nASUS RT-AX58U v3.0.0.4.386.45898\nASUS TUF-AX3000 v3.0.0.4.386.45898"
}
],
"source": {
"advisory": "TVN-202109034",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-37910",
"datePublished": "2021-11-12T01:40:13.569Z",
"dateReserved": "2021-08-02T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:05:28.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3128 (GCVE-0-2021-3128)
Vulnerability from nvd – Published: 2021-04-12 17:41 – Updated: 2024-08-03 16:45
VLAI
Summary
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
27 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:45:51.264Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX88U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX86U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX82U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC5300/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC88U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC3100/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC86U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC2900/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC1750_B1/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC1900/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC1900P/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC1900U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_Download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68P/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware \u003c 3.0.0.4.386.42095 or \u003c 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP\u0027s router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-12T17:41:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX88U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX86U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX82U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC5300/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC88U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC3100/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC86U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC2900/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC1750_B1/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC1900/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC1900P/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC1900U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_Download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68P/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-3128",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware \u003c 3.0.0.4.386.42095 or \u003c 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP\u0027s router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX88U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX88U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX86U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX86U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX82U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX82U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX68U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX68U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC5300/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC5300/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC88U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC88U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC3100/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC3100/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC86U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC86U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC2900/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC2900/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC1750_B1/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC1750_B1/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC1900/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC1900/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC1900P/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC1900P/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC1900U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC1900U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_Download/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_Download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68P/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68P/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-3128",
"datePublished": "2021-04-12T17:41:07.000Z",
"dateReserved": "2021-01-12T00:00:00.000Z",
"dateUpdated": "2024-08-03T16:45:51.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41348 (GCVE-0-2023-41348)
Vulnerability from cvelistv5 – Published: 2023-11-03 04:32 – Updated: 2024-09-06 18:34
VLAI
Title
ASUS RT-AX55 - command injection - 4
Summary
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386.51598
|
|
| asus | rt-ax55_firmware |
Affected:
3.0.0.4.386.51598
cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
Date Public
2023-11-03 06:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:34.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7499-63907-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55_firmware",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-05T15:47:46.461984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T18:34:47.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"datePublic": "2023-11-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-03T07:16:13.129Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7499-63907-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\nUpdate version to 3.0.0.4.386_51948 .\u003cbr\u003e"
}
],
"value": "\n\n\n\n\nUpdate version to 3.0.0.4.386_51948 .\n"
}
],
"source": {
"advisory": "TVN-202311005",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55 - command injection - 4",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-41348",
"datePublished": "2023-11-03T04:32:01.829Z",
"dateReserved": "2023-08-29T00:11:47.812Z",
"dateUpdated": "2024-09-06T18:34:47.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41347 (GCVE-0-2023-41347)
Vulnerability from cvelistv5 – Published: 2023-11-03 04:29 – Updated: 2024-09-04 20:21
VLAI
Title
ASUS RT-AX55 - command injection - 3
Summary
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386.51598
|
|
| asus | rt-ax55_firmware |
Affected:
3.0.0.4.386.51598
cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
Date Public
2023-11-03 06:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:35.328Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7498-18012-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55_firmware",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41347",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-04T20:17:23.869793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-04T20:21:02.091Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"datePublic": "2023-11-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-03T07:15:54.767Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7498-18012-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\nUpdate version to 3.0.0.4.386_51948 .\u003cbr\u003e"
}
],
"value": "\n\n\nUpdate version to 3.0.0.4.386_51948 .\n"
}
],
"source": {
"advisory": "TVN-202311004",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55 - command injection - 3",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-41347",
"datePublished": "2023-11-03T04:29:39.109Z",
"dateReserved": "2023-08-29T00:11:47.812Z",
"dateUpdated": "2024-09-04T20:21:02.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41346 (GCVE-0-2023-41346)
Vulnerability from cvelistv5 – Published: 2023-11-03 04:21 – Updated: 2024-09-06 18:35
VLAI
Title
ASUS RT-AX55 - command injection - 2
Summary
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386.51598
|
|
| asus | rt-ax55_firmware |
Affected:
3.0.0.4.386.51598
cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
Date Public
2023-11-03 06:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:34.461Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7497-f92ac-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55_firmware",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41346",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-05T15:51:29.591472Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T18:35:57.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"datePublic": "2023-11-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-03T07:15:22.787Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7497-f92ac-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nUpdate version to 3.0.0.4.386_51948 .\n\n\u003cbr\u003e"
}
],
"value": "\nUpdate version to 3.0.0.4.386_51948 .\n\n\n"
}
],
"source": {
"advisory": "TVN-202311003",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55 - command injection - 2",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-41346",
"datePublished": "2023-11-03T04:21:26.406Z",
"dateReserved": "2023-08-29T00:11:47.812Z",
"dateUpdated": "2024-09-06T18:35:57.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41345 (GCVE-0-2023-41345)
Vulnerability from cvelistv5 – Published: 2023-11-03 04:16 – Updated: 2024-09-06 18:37
VLAI
Title
ASUS RT-AX55 - command injection - 1
Summary
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386.51598
|
|
| asus | rt-ax55_firmware |
Affected:
3.0.0.4.386.51598
cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
Date Public
2023-11-03 06:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:34.254Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7496-96e2c-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55_firmware",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-05T17:59:46.132221Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T18:37:02.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"datePublic": "2023-11-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services."
}
],
"value": "ASUS RT-AX55\u2019s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-03T07:14:55.631Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7496-96e2c-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update version to\u0026nbsp;3.0.0.4.386_51948 ."
}
],
"value": "Update version to\u00a03.0.0.4.386_51948 ."
}
],
"source": {
"advisory": "TVN-202311002",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55 - command injection - 1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-41345",
"datePublished": "2023-11-03T04:16:47.501Z",
"dateReserved": "2023-08-29T00:11:47.812Z",
"dateUpdated": "2024-09-06T18:37:02.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39780 (GCVE-0-2023-39780)
Vulnerability from cvelistv5 – Published: 2023-09-11 00:00 – Updated: 2025-10-21 23:05Summary
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
Severity
8.8 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
8 references
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:18:09.983Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39780",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-06T03:55:31.213801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-06-02",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-39780"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:05:39.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"url": "https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-39780"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-06-02T00:00:00.000Z",
"value": "CVE-2023-39780 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.51598",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar \"token-generated module\" issue, see CVE-2023-41345; for the similar \"token-refresh module\" issue, see CVE-2023-41346; for the similar \"check token module\" issue, see CVE-2023-41347; and for the similar \"code-authentication module\" issue, see CVE-2023-41348."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-16T16:02:57.679Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md"
},
{
"url": "https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-39780",
"datePublished": "2023-09-11T00:00:00.000Z",
"dateReserved": "2023-08-07T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:05:39.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39240 (GCVE-0-2023-39240)
Vulnerability from cvelistv5 – Published: 2023-09-07 07:25 – Updated: 2024-09-26 19:19
VLAI
Title
ASUS RT-AX55、RT-AX56U_V2 - Format String - 3
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AX56U_V2 |
Affected:
3.0.0.4.386_50460
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386.50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ax55 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:* |
Date Public
2023-09-15 01:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.659Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7356-021bf-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386.50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T19:18:03.026290Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T19:19:30.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AX56U_V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"datePublic": "2023-09-15T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:02:04.782Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7356-021bf-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\u003cp\u003eRT-AX55: update to 3.0.0.4.386_51948 \u003c/p\u003e\u003cp\u003eRT-AX56U_V2: update to 3.0.0.4.386_51948 \u003cbr\u003e\u003c/p\u003e"
}
],
"value": "\nRT-AX55: update to 3.0.0.4.386_51948 \n\nRT-AX56U_V2: update to 3.0.0.4.386_51948 \n\n"
}
],
"source": {
"advisory": "TVN-202309009",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55\u3001RT-AX56U_V2 - Format String - 3",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-39240",
"datePublished": "2023-09-07T07:25:32.504Z",
"dateReserved": "2023-07-26T00:58:24.845Z",
"dateUpdated": "2024-09-26T19:19:30.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39239 (GCVE-0-2023-39239)
Vulnerability from cvelistv5 – Published: 2023-09-07 07:18 – Updated: 2024-09-26 18:56
VLAI
Title
ASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AX56U_V2 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AC86U |
Affected:
3.0.0.4_386_51529
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ax55 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:* |
|
| asus | rt-ac86u |
Affected:
3.0.0.4_386_51529
cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:* |
Date Public
2023-09-15 01:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.688Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ac86u",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T18:53:39.966621Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T18:56:33.349Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AX56U_V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AC86U",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"datePublic": "2023-09-15T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n\u003cbr\u003e\n\n"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:14:38.193Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eRT-AX55: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AX56U_V2: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AC86U: update to 3.0.0.4.386_51915\u003c/p\u003e"
}
],
"value": "\nRT-AX55: update to 3.0.0.4.386_51948\u00a0\n\nRT-AX56U_V2: update to 3.0.0.4.386_51948\u00a0\n\nRT-AC86U: update to 3.0.0.4.386_51915\n\n"
}
],
"source": {
"advisory": "TVN-202309008",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55\u3001RT-AX56U_V2\u3001RT-AC86U - Format String - 2",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-39239",
"datePublished": "2023-09-07T07:18:39.017Z",
"dateReserved": "2023-07-26T00:58:24.844Z",
"dateUpdated": "2024-09-26T18:56:33.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39238 (GCVE-0-2023-39238)
Vulnerability from cvelistv5 – Published: 2023-09-07 07:10 – Updated: 2024-09-26 18:58
VLAI
Title
ASUS RT-AX55、RT-AX56U_V2 - Format String - 1
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AX56U_V2 |
Affected:
3.0.0.4.386_50460
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ax55 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:* |
Date Public
2023-09-15 01:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7354-4e654-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T18:57:07.141155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T18:58:30.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AX56U_V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"datePublic": "2023-09-15T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nIt is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value\u0026nbsp;within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value\u00a0within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:06:35.024Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7354-4e654-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eRT-AX55: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AX56U_V2: update to 3.0.0.4.386_51948\u0026nbsp;\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "\nRT-AX55: update to 3.0.0.4.386_51948\u00a0\n\nRT-AX56U_V2: update to 3.0.0.4.386_51948\u00a0\n\n"
}
],
"source": {
"advisory": "TVN-202309007",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55\u3001RT-AX56U_V2 - Format String - 1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-39238",
"datePublished": "2023-09-07T07:10:47.153Z",
"dateReserved": "2023-07-26T00:58:24.844Z",
"dateUpdated": "2024-09-26T18:58:30.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-26376 (GCVE-0-2022-26376)
Vulnerability from cvelistv5 – Published: 2022-08-05 21:18 – Updated: 2025-04-15 18:53
VLAI
Summary
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Asuswrt-Merlin | Asuswrt-Merlin New Gen |
Affected:
prior to 386.7
|
Date Public
2022-07-27 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:03:32.976Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-26376",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-15T18:18:45.679502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T18:53:55.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Asuswrt-Merlin New Gen",
"vendor": "Asuswrt-Merlin",
"versions": [
{
"status": "affected",
"version": "prior to 386.7"
}
]
}
],
"datePublic": "2022-07-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-07T00:00:00.000Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2022-26376",
"datePublished": "2022-08-05T21:18:47.095Z",
"dateReserved": "2022-04-05T00:00:00.000Z",
"dateUpdated": "2025-04-15T18:53:55.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43702 (GCVE-0-2021-43702)
Vulnerability from cvelistv5 – Published: 2022-07-05 11:50 – Updated: 2024-08-04 04:03
VLAI
Summary
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.asus.com/uk/Networking-IoT-Servers/Wi… | x_refsource_MISC |
| https://www.kroll.com/en/insights/publications/cy… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:03:08.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-05T11:50:03.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-43702",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/",
"refsource": "MISC",
"url": "https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/"
},
{
"name": "https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch",
"refsource": "MISC",
"url": "https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-43702",
"datePublished": "2022-07-05T11:50:03.000Z",
"dateReserved": "2021-11-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T04:03:08.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41435 (GCVE-0-2021-41435)
Vulnerability from cvelistv5 – Published: 2021-11-19 11:26 – Updated: 2024-08-04 03:15
VLAI
Summary
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://asus.com | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/Whole… | x_refsource_MISC |
| https://rog.asus.com/networking/rog-rapture-gt-ax… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/Whole… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:15:27.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://asus.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-19T11:26:30.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://asus.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-41435",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://asus.com",
"refsource": "MISC",
"url": "http://asus.com"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"name": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios",
"refsource": "MISC",
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-41435",
"datePublished": "2021-11-19T11:26:30.000Z",
"dateReserved": "2021-09-20T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:15:27.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41436 (GCVE-0-2021-41436)
Vulnerability from cvelistv5 – Published: 2021-11-19 11:14 – Updated: 2024-08-04 03:15
VLAI
Summary
An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://asus.com | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/Whole… | x_refsource_MISC |
| https://rog.asus.com/networking/rog-rapture-gt-ax… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/WiFi-… | x_refsource_MISC |
| https://www.asus.com/Networking-IoT-Servers/Whole… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:15:28.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://asus.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-19T11:14:09.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://asus.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-41436",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://asus.com",
"refsource": "MISC",
"url": "http://asus.com"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"name": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios",
"refsource": "MISC",
"url": "https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-41436",
"datePublished": "2021-11-19T11:14:09.000Z",
"dateReserved": "2021-09-20T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:15:28.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-37910 (GCVE-0-2021-37910)
Vulnerability from cvelistv5 – Published: 2021-11-12 01:40 – Updated: 2024-09-16 19:05
VLAI
Title
ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication
Summary
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
Severity
CWE
- CWE-799 - Improper Control of Interaction Frequency
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html | x_refsource_MISC |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | GT-AXE11000 |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
|
| ASUS | RT-AX3000 |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
|
| ASUS | RT-AX55 |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
|
| ASUS | RT-AX58U |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
|
| ASUS | TUF-AX3000 |
Affected:
unspecified , < 3.0.0.4.386.45898
(custom)
|
Date Public
2021-11-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:30:09.144Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GT-AXE11000",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "RT-AX3000",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "RT-AX58U",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TUF-AX3000",
"vendor": "ASUS",
"versions": [
{
"lessThan": "3.0.0.4.386.45898",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-11-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users\u0027 connections by sending specially crafted SAE authentication frames."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "CWE-799 Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-12T01:40:13.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Routes firmware to last version:\nASUS GT-AXE11000 v3.0.0.4.386.45898\nASUS RT-AX3000 v3.0.0.4.386.45898\nASUS RT-AX55 v3.0.0.4.386.45898\nASUS RT-AX58U v3.0.0.4.386.45898\nASUS TUF-AX3000 v3.0.0.4.386.45898"
}
],
"source": {
"advisory": "TVN-202109034",
"discovery": "EXTERNAL"
},
"title": "ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-11-12T07:06:00.000Z",
"ID": "CVE-2021-37910",
"STATE": "PUBLIC",
"TITLE": "ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "GT-AXE11000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
},
{
"product_name": "RT-AX3000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
},
{
"product_name": "RT-AX55",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
},
{
"product_name": "RT-AX58U",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
},
{
"product_name": "TUF-AX3000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0.0.4.386.45898"
}
]
}
}
]
},
"vendor_name": "ASUS"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users\u0027 connections by sending specially crafted SAE authentication frames."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-799 Improper Control of Interaction Frequency"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Routes firmware to last version:\nASUS GT-AXE11000 v3.0.0.4.386.45898\nASUS RT-AX3000 v3.0.0.4.386.45898\nASUS RT-AX55 v3.0.0.4.386.45898\nASUS RT-AX58U v3.0.0.4.386.45898\nASUS TUF-AX3000 v3.0.0.4.386.45898"
}
],
"source": {
"advisory": "TVN-202109034",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-37910",
"datePublished": "2021-11-12T01:40:13.569Z",
"dateReserved": "2021-08-02T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:05:28.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3128 (GCVE-0-2021-3128)
Vulnerability from cvelistv5 – Published: 2021-04-12 17:41 – Updated: 2024-08-03 16:45
VLAI
Summary
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
27 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:45:51.264Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX88U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX86U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX82U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC5300/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC88U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC3100/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC86U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC2900/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC1750_B1/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC1900/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC1900P/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC1900U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_Download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68P/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware \u003c 3.0.0.4.386.42095 or \u003c 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP\u0027s router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-12T17:41:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX88U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX86U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX82U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX68U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC5300/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC88U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC3100/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC86U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC2900/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC1750_B1/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC1900/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC1900P/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC1900U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_Download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68P/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-3128",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware \u003c 3.0.0.4.386.42095 or \u003c 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP\u0027s router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX88U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX88U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX86U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX86U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX82U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX82U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX68U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX68U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC5300/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC5300/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC88U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC88U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC3100/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC3100/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC86U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC86U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC2900/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC2900/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC1750_B1/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC1750_B1/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC1900/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC1900/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC1900P/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC1900P/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC1900U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC1900U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_Download/",
"refsource": "MISC",
"url": "https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_Download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68P/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68P/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/"
},
{
"name": "https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/",
"refsource": "MISC",
"url": "https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-3128",
"datePublished": "2021-04-12T17:41:07.000Z",
"dateReserved": "2021-01-12T00:00:00.000Z",
"dateUpdated": "2024-08-03T16:45:51.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}