CVSS: 10.0EPSS: 70%CPEs: 7EXPL: 0CVE-2024-3080 – ASUS Router - Improper Authentication
https://notcve.org/view.php?id=CVE-2024-3080
14 Jun 2024 — Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device. Ciertos modelos de enrutadores ASUS tienen una vulnerabilidad de omisión de autenticación, lo que permite a atacantes remotos no autenticados iniciar sesión en el dispositivo. • https://www.twcert.org.tw/en/cp-139-7860-760b1-2.html • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 0%CPEs: 7EXPL: 0CVE-2024-3079 – ASUS Router - Stack-based Buffer Overflow
https://notcve.org/view.php?id=CVE-2024-3079
14 Jun 2024 — Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device. Ciertos modelos de enrutadores ASUS tienen vulnerabilidades de desbordamiento de búfer, lo que permite a atacantes remotos con privilegios administrativos ejecutar comandos arbitrarios en el dispositivo. • https://www.twcert.org.tw/en/cp-139-7858-3c978-2.html • CWE-121: Stack-based Buffer Overflow •
CVSS: 8.5EPSS: 1%CPEs: 15EXPL: 0CVE-2024-0401 – ASUS OVPN RCE
https://notcve.org/view.php?id=CVE-2024-0401
20 May 2024 — ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000. Los enrutadores ASUS que admiten perfiles OpenVPN personalizados son afectados por una vulnerabilidad de e... • https://vulncheck.com/advisories/asus-ovpn-rce • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37315
https://notcve.org/view.php?id=CVE-2021-37315
03 Feb 2023 — Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37316
https://notcve.org/view.php?id=CVE-2021-37316
03 Feb 2023 — SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.4EPSS: 1%CPEs: 2EXPL: 1CVE-2021-37317
https://notcve.org/view.php?id=CVE-2021-37317
03 Feb 2023 — Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the target for COPY and MOVE operations. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 188EXPL: 1CVE-2021-43702
https://notcve.org/view.php?id=CVE-2021-43702
05 Jul 2022 — ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device. ASUS RT-A88U versión 3.0.0.4.386_45898 es vulnerable a un ataque de tipo Cross Site Scripting (XSS). El panel de administración del enrutador ASUS no desinfecta los registros de WiFI correctamente, si un atacante pudiera cambiar el SSI... • https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-45757
https://notcve.org/view.php?id=CVE-2021-45757
23 Mar 2022 — ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS). ASUS AC68U versiones anteriores a 3.0.0.4.385.20852 incluyéndola, está afectado por un desbordamiento de búfer en el archivo blocking.cgi, que puede causar una denegación de servicio (DoS) • http://ac68u.com • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-45756
https://notcve.org/view.php?id=CVE-2021-45756
23 Mar 2022 — Asus RT-AC68U <3.0.0.4.385.20633 and RT-AC5300 <3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi. Asus RT-AC68U versiones anteriores a 3.0.0.4.385.20633 y RT-AC5300 versiones anteriores a 3.0.0.4.384.82072, están afectados por un desbordamiento de búfer en el archivo blocking_request.cgi • http://asus.com • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 2%CPEs: 108EXPL: 0CVE-2021-3128
https://notcve.org/view.php?id=CVE-2021-3128
12 Apr 2021 — In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for wh... • https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS • CWE-834: Excessive Iteration •