CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37315
https://notcve.org/view.php?id=CVE-2021-37315
03 Feb 2023 — Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37316
https://notcve.org/view.php?id=CVE-2021-37316
03 Feb 2023 — SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.4EPSS: 1%CPEs: 2EXPL: 1CVE-2021-37317
https://notcve.org/view.php?id=CVE-2021-37317
03 Feb 2023 — Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the target for COPY and MOVE operations. • https://robertchen.cc/blog/2021/03/31/asus-rce • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 188EXPL: 1CVE-2021-43702
https://notcve.org/view.php?id=CVE-2021-43702
05 Jul 2022 — ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device. ASUS RT-A88U versión 3.0.0.4.386_45898 es vulnerable a un ataque de tipo Cross Site Scripting (XSS). El panel de administración del enrutador ASUS no desinfecta los registros de WiFI correctamente, si un atacante pudiera cambiar el SSI... • https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-45757
https://notcve.org/view.php?id=CVE-2021-45757
23 Mar 2022 — ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS). ASUS AC68U versiones anteriores a 3.0.0.4.385.20852 incluyéndola, está afectado por un desbordamiento de búfer en el archivo blocking.cgi, que puede causar una denegación de servicio (DoS) • http://ac68u.com • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-45756
https://notcve.org/view.php?id=CVE-2021-45756
23 Mar 2022 — Asus RT-AC68U <3.0.0.4.385.20633 and RT-AC5300 <3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi. Asus RT-AC68U versiones anteriores a 3.0.0.4.385.20633 y RT-AC5300 versiones anteriores a 3.0.0.4.384.82072, están afectados por un desbordamiento de búfer en el archivo blocking_request.cgi • http://asus.com • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 2%CPEs: 108EXPL: 0CVE-2021-3128
https://notcve.org/view.php?id=CVE-2021-3128
12 Apr 2021 — In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for wh... • https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS • CWE-834: Excessive Iteration •
CVSS: 9.8EPSS: 8%CPEs: 28EXPL: 2CVE-2018-18319
https://notcve.org/view.php?id=CVE-2018-18319
15 Oct 2018 — An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution ** EN DISPUTA ** Se ha descubierto un problema en la versión 0.6.6 del componente Merlin.PHP para dispositivos Asuswrt-Merlin.... • http://blog.51cto.com/010bjsoft/2298902 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 7%CPEs: 28EXPL: 2CVE-2018-18320
https://notcve.org/view.php?id=CVE-2018-18320
15 Oct 2018 — An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution ** EN DISPUTA ** Se ha descubierto un problema en la versión 0.6.6 del componente Merlin.PHP para dispositivos Asuswrt-Merlin. Un atacante puede ejecutar comandos arbitrarios debido a que exec.php tiene... • http://blog.51cto.com/010bjsoft/2298828 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-0582
https://notcve.org/view.php?id=CVE-2018-0582
14 May 2018 — Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en ASUS RT-AC68U con versión de firmware anterior a la 3.0.0.4.380.1031 permite que los atacantes remotos inyecten scripts web o HTML arbitrarios utilizando vectores no especificados. • http://jvn.jp/en/jp/JVN73742314/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •