CVSS: 9.3EPSS: 1%CPEs: 56EXPL: 0CVE-2017-11344
https://notcve.org/view.php?id=CVE-2017-11344
Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to write shellcode at any address in the heap; this can be used to execute arbitrary code on the router by hosting a crafted device description XML document at a URL specified within a Location header in an SSDP response. Un Desbordamiento de búfer global en networkmap en el firmware Asuswrt-Merlin para dispositivos ASUS y en el firmware ASUS para dispositivos RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 de ASUS, permiten a los atacantes remotos escribir código shell en cualquier dirección de la pila; esto puede ser utilizado para ejecutar código arbitrario en el enrutador mediante el alojamiento de un documento XML creado de descripción de dispositivo en una URL especificada dentro de un encabezado Location en una respuesta SSDP. • http://www.openwall.com/lists/oss-security/2017/07/14/3 https://asuswrt.lostrealm.ca/changelog • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 1%CPEs: 56EXPL: 0CVE-2017-11345
https://notcve.org/view.php?id=CVE-2017-11345
Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by hosting a crafted device description XML document (that includes a serviceType element) at a URL specified within a Location header in an SSDP response. Un desbordamiento del búfer de la pila en networkmap en el firmware Asuswrt-Merlin para dispositivos ASUS y firmware ASUS para dispositivos RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 de ASUS, permiten que los atacantes remotos ejecuten código arbitrario en el enrutador mediante el alojamiento de un documento XML creado de descripción de dispositivo (que incluye un elemento serviceType) en una URL especificada dentro de un encabezado Location en una respuesta SSDP. • http://www.openwall.com/lists/oss-security/2017/07/14/3 https://asuswrt.lostrealm.ca/changelog • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.3EPSS: 0%CPEs: 52EXPL: 0CVE-2014-2719 – ASUS RT Password Disclosure
https://notcve.org/view.php?id=CVE-2014-2719
Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code. Advanced_System_Content.asp en routers de la serie ASUS RT con firmware anterior a 3.0.0.4.374.5517, cuando una sesión de administrador está activa, permite a usuarios remotos autenticados obtener el nombre de usuario y contraseña del administrador mediante la lectura del código fuente. ASUS RT series of routers disclose administrative credentials. • http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html http://seclists.org/fulldisclosure/2014/Apr/225 http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 https://support.t-mobile.com/docs/DOC-21994 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 19%CPEs: 6EXPL: 3CVE-2013-6343 – ASUS RT-N56U - Remote Buffer Overflow (ROP)
https://notcve.org/view.php?id=CVE-2013-6343
Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow remote attackers to execute arbitrary code via the (1) apps_name or (2) apps_flag parameter to APP_Installation.asp. Múltiples desbordamientos de búfer en web.c de httpd en routers ASUS RT-N56U y RT-AC66U con firmware 3.0.0.4.374_979 permite a atacantes remotos ejecutar código arbitrario a través de parámetros (1) apps_name o (2) apps_flag hacia APP_Installation.asp. • https://www.exploit-db.com/exploits/31033 http://infosec42.blogspot.com/2014/01/exploit-asus-rt-n56u-remote-root-shell.html http://osvdb.org/102267 http://www.exploit-db.com/exploits/31033 http://www.securityfocus.com/bid/65046 https://support.t-mobile.com/docs/DOC-21994 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 51EXPL: 0CVE-2013-4937
https://notcve.org/view.php?id=CVE-2013-4937
Multiple unspecified vulnerabilities in the AiCloud feature on the ASUS RT-AC66U, RT-N66U, RT-N65U, RT-N14U, RT-N16, RT-N56U, and DSL-N55U with firmware before 3.0.4.372 have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en la característica AiCloud de los ASUS RT-AC66U, RT-N66U, RT-N65U, RT-N14U, RT-N16, RT-N56U, y DSL-N55U con firmware anteriores a v3.0.4.372 tienen impacto y vectores de ataque desconocidos. • http://reviews.cnet.com/8301-3132_7-57594003-98 http://twitter.com/ASUSUSA/statuses/357612236392509440 •