PT-2014-4883 · Asus · Rt-Ac56U+8

Published 2014-11-04 · Updated 2017-08-29 · CVE-2014-2718

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions ASUS RT-AC68U versions prior to 3.0.0.4.376.x ASUS RT-AC66R versions prior to 3.0.0.4.376.x ASUS RT-AC66U versions prior to 3.0.0.4.376.x ASUS RT-AC56R versions prior to 3.0.0.4.376.x ASUS RT-AC56U versions prior to 3.0.0.4.376.x ASUS RT-N66R versions prior to 3.0.0.4.376.x ASUS RT-N66U versions prior to 3.0.0.4.376.x ASUS RT-N56R versions prior to 3.0.0.4.376.x ASUS RT-N56U versions prior to 3.0.0.4.376.x

Description The issue allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image, as the routers do not verify the integrity of firmware update information or downloaded updates.

Recommendations For ASUS RT-AC68U versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later. For ASUS RT-AC66R versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later. For ASUS RT-AC66U versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later. For ASUS RT-AC56R versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later. For ASUS RT-AC56U versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later. For ASUS RT-N66R versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later. For ASUS RT-N66U versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later. For ASUS RT-N56R versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later. For ASUS RT-N56U versions prior to 3.0.0.4.376.x, update the firmware to version 3.0.0.4.376.x or later.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2014-2718

Affected Products

Rt-Ac56R

Rt-Ac56U

Rt-Ac66R

Rt-Ac66U

Rt-Ac68U

Rt-N56R

Rt-N56U

Rt-N66R

Rt-N66U

References · 7

• 🔥 http://packetstormsecurity.com/files/128904/ASUS-Router-Man-In-The-Middle.html · Exploit
• 🔥 http://dnlongen.blogspot.com/2014/10/CVE-2014-2718-Asus-RT-MITM.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Oct/122 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2718 · Security Note
• https://support.t-mobile.com/docs/DOC-21994 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98316 · Note
• http://securityfocus.com/bid/70791 · Note