PT-2018-5690 · Asus · Asus Dsl-Ac52U+12

Publicado 2018-01-29 · Atualizado 2019-10-03 · CVE-2017-14698

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10 C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers (affected versions not specified)

Description: The issue allows remote attackers to change passwords of arbitrary users via the http passwd parameter to the "mod login.asp" endpoint.

Recommendations: For all affected routers, as a temporary workaround, consider restricting access to the "mod login.asp" endpoint until a patch is available. Avoid using the http passwd parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-14698

Produtos afetados

Asus Dsl-Ac51

Asus Dsl-Ac52U

Asus Dsl-Ac55U

Asus Dsl-Ac56U

Asus Dsl-Ac750

Asus Dsl-N10 C1

Asus Dsl-N12E C1

Asus Dsl-N14U

Asus Dsl-N14U-B1

Asus Dsl-N16

Asus Dsl-N17U

Asus Dsl-N55U C1

Asus Dsl-N66U

Referências · 3

• https://securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers · Nota
• https://asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14698 · Nota de Segurança