PT-2018-5962 · Asus · Asuswrt

Blazej Adamczyk · Publicado 2018-01-31 · Atualizado 2018-02-21 · CVE-2017-15655

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Asus asuswrt versions prior to 3.0.0.4.378

Description: The issue is related to multiple buffer overflow vulnerabilities in the HTTPd server. These vulnerabilities can be exploited to achieve remote code execution (RCE) with administrator rights when the administrator visits specific pages. Some end-of-life routers are affected as they have a vulnerable version as their latest update.

Recommendations: For versions prior to 3.0.0.4.378, update to version 3.0.0.4.378 or later to resolve the issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-15655

Produtos afetados

Asuswrt

Referências · 5

• 🔥 http://sploit.tech/2018/01/16/ASUS-part-I.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Jan/63 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15655 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-15655 · Aviso do Fabricante
• http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html · Nota