CVSS: 9.3EPSS: 1%CPEs: 56EXPL: 0CVE-2017-11344
https://notcve.org/view.php?id=CVE-2017-11344
Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to write shellcode at any address in the heap; this can be used to execute arbitrary code on the router by hosting a crafted device description XML document at a URL specified within a Location header in an SSDP response. Un Desbordamiento de búfer global en networkmap en el firmware Asuswrt-Merlin para dispositivos ASUS y en el firmware ASUS para dispositivos RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 de ASUS, permiten a los atacantes remotos escribir código shell en cualquier dirección de la pila; esto puede ser utilizado para ejecutar código arbitrario en el enrutador mediante el alojamiento de un documento XML creado de descripción de dispositivo en una URL especificada dentro de un encabezado Location en una respuesta SSDP. • http://www.openwall.com/lists/oss-security/2017/07/14/3 https://asuswrt.lostrealm.ca/changelog • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 1%CPEs: 56EXPL: 0CVE-2017-11345
https://notcve.org/view.php?id=CVE-2017-11345
Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by hosting a crafted device description XML document (that includes a serviceType element) at a URL specified within a Location header in an SSDP response. Un desbordamiento del búfer de la pila en networkmap en el firmware Asuswrt-Merlin para dispositivos ASUS y firmware ASUS para dispositivos RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 de ASUS, permiten que los atacantes remotos ejecuten código arbitrario en el enrutador mediante el alojamiento de un documento XML creado de descripción de dispositivo (que incluye un elemento serviceType) en una URL especificada dentro de un encabezado Location en una respuesta SSDP. • http://www.openwall.com/lists/oss-security/2017/07/14/3 https://asuswrt.lostrealm.ca/changelog • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •