PT-2015-3921 · Asus · Asus Rt-Ac56S+4

Publicado 2015-02-01 · Atualizado 2015-02-11 · CVE-2014-7270

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ASUS RT-AC87U routers versions 3.0.0.4.378.3754 and earlier ASUS RT-AC68U routers versions 3.0.0.4.376.3715 and earlier ASUS RT-AC56S routers versions 3.0.0.4.376.3715 and earlier ASUS RT-N66U routers versions 3.0.0.4.376.3715 and earlier ASUS RT-N56U routers versions 3.0.0.4.376.3715 and earlier

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users. This can be exploited by tricking a user into performing unintended actions on the router.

Recommendations For ASUS RT-AC87U routers versions 3.0.0.4.378.3754 and earlier, update the firmware to a version later than 3.0.0.4.378.3754. For ASUS RT-AC68U routers versions 3.0.0.4.376.3715 and earlier, update the firmware to a version later than 3.0.0.4.376.3715. For ASUS RT-AC56S routers versions 3.0.0.4.376.3715 and earlier, update the firmware to a version later than 3.0.0.4.376.3715. For ASUS RT-N66U routers versions 3.0.0.4.376.3715 and earlier, update the firmware to a version later than 3.0.0.4.376.3715. For ASUS RT-N56U routers versions 3.0.0.4.376.3715 and earlier, update the firmware to a version later than 3.0.0.4.376.3715.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-7270

Produtos afetados

Asus Rt-Ac56S

Asus Rt-Ac68U

Asus Rt-Ac87U

Asus Rt-N56U

Asus Rt-N66U

Referências · 4

• http://jvn.jp/en/jp/JVN32631078/index.html · Aviso do Fabricante
• http://asus.com/jp/News/PNzPd7vkXtrKWXHR · Aviso do Fabricante
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000012 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-7270 · Nota de Segurança