PT-2018-13842 · Asus · Asus Gt-Ac5300

Bigbear · Publicado 2018-09-13 · Atualizado 2018-11-07 · CVE-2018-17021

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ASUS GT-AC5300 devices with firmware through 3.0.0.4.384 32738

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the appGet.cgi hook parameter. This could potentially lead to unauthorized actions on the device.

Recommendations For firmware versions through 3.0.0.4.384 32738, as a temporary workaround, consider restricting access to the appGet.cgi endpoint until a patch is available. Avoid using the hook parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-17021

Produtos afetados

Asus Gt-Ac5300

Referências · 3

• 🔥 https://github.com/PAGalaxyLab/VulInfo/blob/master/ASUS/ac5300_xss/ASUS%20GT-AC5300%20XSS.MD · Exploit
• https://osv.dev/vulnerability/CVE-2018-17021 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17021 · Nota de Segurança