PT-2018-14395 · Asus · Asus Rt-Ac58U

Syrex1013 · Publicado 2018-10-14 · Atualizado 2018-12-04 · CVE-2018-18291

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ASUS RT-AC58U version 3.0.0.4.380 6516

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via various pages, including Advanced ASUSDDNS Content.asp, Advanced WSecurity Content.asp, Advanced Wireless Content.asp, Logout.asp, Main Login.asp, MobileQIS Login.asp, QIS wizard.htma, YandexDNS.asp, ajax status.xml, apply.cgi, clients.asp, disk.asp, disk utility.asp, or internet.asp.

Recommendations For ASUS RT-AC58U version 3.0.0.4.380 6516, consider restricting access to the mentioned pages as a temporary workaround until a patch is available. Avoid using the affected device for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-18291

Produtos afetados

Asus Rt-Ac58U

Referências · 3

• 🔥 https://github.com/remix30303/AsusXSS · Exploit
• https://osv.dev/vulnerability/CVE-2018-18291 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18291 · Nota de Segurança