CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37316
https://notcve.org/view.php?id=CVE-2021-37316
SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37315
https://notcve.org/view.php?id=CVE-2021-37315
Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37317
https://notcve.org/view.php?id=CVE-2021-37317
Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the target for COPY and MOVE operations. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 188EXPL: 1CVE-2021-43702
https://notcve.org/view.php?id=CVE-2021-43702
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device. ASUS RT-A88U versión 3.0.0.4.386_45898 es vulnerable a un ataque de tipo Cross Site Scripting (XSS). El panel de administración del enrutador ASUS no desinfecta los registros de WiFI correctamente, si un atacante pudiera cambiar el SSID del enrutador con una carga útil personalizada, podría obtener XSS almacenado en el dispositivo • https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-45757
https://notcve.org/view.php?id=CVE-2021-45757
ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS). ASUS AC68U versiones anteriores a 3.0.0.4.385.20852 incluyéndola, está afectado por un desbordamiento de búfer en el archivo blocking.cgi, que puede causar una denegación de servicio (DoS) • http://ac68u.com http://asus.com https://github.com/IBUILI/Asus • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •