CVSS: 7.5EPSS: 1%CPEs: 108EXPL: 0CVE-2021-3128
https://notcve.org/view.php?id=CVE-2021-3128
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set. En ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U y otros enrutadores ASUS con versiones de firmware anteriores a 3.0.0.4.386.42095 o versiones anteriores a 9.0.0.4.386.41994, cuando una IPv6 es usada, puede ocurrir un bucle de enrutamiento que genera un tráfico excesivo de red entre un dispositivo afectado y el enrutador de su ISP aguas arriba. Esto ocurre cuando una ruta de prefijo de enlace apunta a un enlace punto a punto, una dirección IPv6 de destino pertenece al prefijo y no es una dirección IPv6 local, y un anuncio de enrutador es recibido con al menos un prefijo IPv6 único global para el cual el flag on-link se establece • https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX56U/HelpDesk_BIOS https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX58U/HelpDesk_BIOS https://www. • CWE-834: Excessive Iteration •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2018-18291
https://notcve.org/view.php?id=CVE-2018-18291
A cross site scripting (XSS) vulnerability on ASUS RT-AC58U 3.0.0.4.380_6516 devices allows remote attackers to inject arbitrary web script or HTML via Advanced_ASUSDDNS_Content.asp, Advanced_WSecurity_Content.asp, Advanced_Wireless_Content.asp, Logout.asp, Main_Login.asp, MobileQIS_Login.asp, QIS_wizard.htma, YandexDNS.asp, ajax_status.xml, apply.cgi, clients.asp, disk.asp, disk_utility.asp, or internet.asp. Una vulnerabilidad Cross-Site Scripting (XSS) en dispositivos ASUS RT-AC58U 3.0.0.4.380_6516 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante Advanced_ASUSDDNS_Content.asp, Advanced_WSecurity_Content.asp, Advanced_Wireless_Content.asp, Logout.asp, Main_Login.asp, MobileQIS_Login.asp, QIS_wizard.htma, YandexDNS.asp, ajax_status.xml, apply.cgi, clients.asp, disk.asp, disk_utility.asp o internet.asp. • https://github.com/remix30303/AsusXSS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2018-18287
https://notcve.org/view.php?id=CVE-2018-18287
On ASUS RT-AC58U 3.0.0.4.380_6516 devices, remote attackers can discover hostnames and IP addresses by reading dhcpLeaseInfo data in the HTML source code of the Main_Login.asp page. En dispositivos ASUS RT-AC58U 3.0.0.4.380_6516, los atacantes remotos pueden descubrir nombres de host y direcciones IP leyendo datos dhcpLeaseInfo en el código fuente HTML de la página Main_Login.asp. • https://github.com/remix30303/AsusLeak • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 8%CPEs: 26EXPL: 0CVE-2018-8826
https://notcve.org/view.php?id=CVE-2018-8826
ASUS RT-AC51U, RT-AC58U, RT-AC66U, RT-AC1750, RT-ACRH13, and RT-N12 D1 routers with firmware before 3.0.0.4.380.8228; RT-AC52U B1, RT-AC1200 and RT-N600 routers with firmware before 3.0.0.4.380.10446; RT-AC55U and RT-AC55UHP routers with firmware before 3.0.0.4.382.50276; RT-AC86U and RT-AC2900 routers with firmware before 3.0.0.4.384.20648; and possibly other RT-series routers allow remote attackers to execute arbitrary code via unspecified vectors. Los routers ASUS RT-AC51U, RT-AC58U, RT-AC66U, RT-AC1750, RT-ACRH13 y RT-N12 D1 con firmware anterior a 3.0.0.4.380.8228; los routers RT-AC52U B1, RT-AC1200 y RT-N600 con firmware anterior a 3.0.0.4.380.10446; los routers RT-AC55U y RT-AC55UHP con firmware anterior a 3.0.0.4.382.50276; los routers RT-AC86U y RT-AC2900 con firmware anterior a 3.0.0.4.384.20648; y posiblemente otros routers de la serie RT, permiten que atacantes remotos ejecuten código arbitrario mediante vectores sin especificar. • https://www.asus.com/Networking/RT-AC2900/HelpDesk_BIOS https://www.asus.com/Networking/RT-AC52U-B1/HelpDesk_BIOS https://www.asus.com/ca-en/Networking/RT-N600/HelpDesk_Download https://www.asus.com/sg/Networking/RT-AC58U/HelpDesk_BIOS https://www.asus.com/us/Networking/RT-AC1200/HelpDesk_BIOS https://www.asus.com/us/Networking/RT-AC1750/HelpDesk_BIOS https://www.asus.com/us/Networking/RT-AC86U/HelpDesk_BIOS https://www.asus.com/us/Networking/RT-ACRH13/HelpDesk_BIOS • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 3%CPEs: 56EXPL: 1CVE-2017-11420
https://notcve.org/view.php?id=CVE-2017-11420
Stack-based buffer overflow in ASUS_Discovery.c in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code via long device information that is mishandled during a strcat to a device list. Un desbordamiento de búfer en la región stack de la memoria en el archivo ASUS_Discovery.c en componente networkmap en firmware Asuswrt-Merlin para dispositivos ASUS y firmware ASUS para dispositivos ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, y RT-N300, permiten que los atacantes remotos ejecuten código arbitrario por medio de información de dispositivo larga que es manejada inapropiadamente durante un strcat en una lista de dispositivos. • http://www.openwall.com/lists/oss-security/2017/07/13/1 https://asuswrt.lostrealm.ca/changelog • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •