PT-2014-4884 · Asus · Asus Rt Series

Publicado 2014-04-21 · Atualizado 2016-06-30 · CVE-2014-2719

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Média

Vetor base

AV:N/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASUS RT series routers versions prior to 3.0.0.4.374.5517

Description The issue allows remote authenticated users to obtain the administrator user name and password by reading the source code of the Advanced System Content.asp page when an administrator session is active.

Recommendations For versions prior to 3.0.0.4.374.5517, update the firmware to version 3.0.0.4.374.5517 or later to resolve the issue. As a temporary workaround, consider restricting access to the Advanced System Content.asp page until the firmware is updated.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-2719

Produtos afetados

Asus Rt Series

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-2719 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Apr/225 · Nota
• https://support.t-mobile.com/docs/DOC-21994 · Nota
• http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 · Nota
• http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html · Nota