PT-2014-4884 · Asus · Asus Rt Series

Published 2014-04-21 · Updated 2016-06-30 · CVE-2014-2719

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASUS RT series routers versions prior to 3.0.0.4.374.5517

Description The issue allows remote authenticated users to obtain the administrator user name and password by reading the source code of the Advanced System Content.asp page when an administrator session is active.

Recommendations For versions prior to 3.0.0.4.374.5517, update the firmware to version 3.0.0.4.374.5517 or later to resolve the issue. As a temporary workaround, consider restricting access to the Advanced System Content.asp page until the firmware is updated.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-2719

Affected Products

Asus Rt Series

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-2719 · Security Note
• http://seclists.org/fulldisclosure/2014/Apr/225 · Note
• https://support.t-mobile.com/docs/DOC-21994 · Note
• http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 · Note
• http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html · Note