PT-2014-3097 · Asus · Asus Rt-N56U+1

Published 2014-01-22 · Updated 2016-12-31 · CVE-2013-6343

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374 979

Description The issue is related to multiple buffer overflows in the httpd web.c component. Remote attackers can execute arbitrary code by manipulating the apps name or apps flag parameters in the APP Installation.asp endpoint.

Recommendations For ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374 979, consider restricting access to the APP Installation.asp endpoint until a patch is available. As a temporary workaround, avoid using the apps name and apps flag parameters in the APP Installation.asp endpoint to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-6343

Affected Products

Asus Rt-Ac66U

Asus Rt-N56U

References · 7

• 🔥 http://infosec42.blogspot.com/2014/01/exploit-asus-rt-n56u-remote-root-shell.html · Exploit
• 🔥 http://exploit-db.com/exploits/31033 · Exploit
• 🔥 https://exploit-db.com/exploits/31033 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6343 · Security Note
• http://osvdb.org/102267 · Note
• https://support.t-mobile.com/docs/DOC-21994 · Note
• http://securityfocus.com/bid/65046 · Note