PT-2023-23221 · Asus · Asus Router Rt-Ax3000

Shungo Kumasaka · Publicado 2023-06-13 · Atualizado 2025-01-03 · CVE-2023-31195

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403

Description The issue arises from the use of sensitive cookies without the 'Secure' attribute. This allows an attacker, who can mount a man-in-the-middle attack, to potentially hijack a user's session if the user logs into the affected device through an unencrypted 'http' connection.

Recommendations For ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403, update to version 3.0.0.4.388.23403 or later to resolve the issue. As a temporary workaround, consider restricting access to the device through unencrypted connections to minimize the risk of session hijacking.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2023-31195

Produtos afetados

Asus Router Rt-Ax3000

Referências · 8

• https://t.me/cvenotify/106240 · Publicação no Telegram
• https://jvn.jp/en/jp/JVN34232595 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-31195 · Nota de Segurança
• https://t.me/true_secator/4523 · Publicação no Telegram
• https://t.me/cvenotify/52169 · Publicação no Telegram
• https://asus.com/networking-iot-servers/wifi-routers/asus-wifi-routers/rt-ax3000/helpdesk_bios/?model2Name=RT-AX3000 · Nota
• https://t.me/cvenotify/52810 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-31195 · Aviso do Fabricante