PT-2015-3921 · Asus · Asus Rt-Ac56S+4

Published 2015-02-01 · Updated 2015-02-11 · CVE-2014-7270

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ASUS RT-AC87U routers versions 3.0.0.4.378.3754 and earlier ASUS RT-AC68U routers versions 3.0.0.4.376.3715 and earlier ASUS RT-AC56S routers versions 3.0.0.4.376.3715 and earlier ASUS RT-N66U routers versions 3.0.0.4.376.3715 and earlier ASUS RT-N56U routers versions 3.0.0.4.376.3715 and earlier

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users. This can be exploited by tricking a user into performing unintended actions on the router.

Recommendations For ASUS RT-AC87U routers versions 3.0.0.4.378.3754 and earlier, update the firmware to a version later than 3.0.0.4.378.3754. For ASUS RT-AC68U routers versions 3.0.0.4.376.3715 and earlier, update the firmware to a version later than 3.0.0.4.376.3715. For ASUS RT-AC56S routers versions 3.0.0.4.376.3715 and earlier, update the firmware to a version later than 3.0.0.4.376.3715. For ASUS RT-N66U routers versions 3.0.0.4.376.3715 and earlier, update the firmware to a version later than 3.0.0.4.376.3715. For ASUS RT-N56U routers versions 3.0.0.4.376.3715 and earlier, update the firmware to a version later than 3.0.0.4.376.3715.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-7270

Affected Products

Asus Rt-Ac56S

Asus Rt-Ac68U

Asus Rt-Ac87U

Asus Rt-N56U

Asus Rt-N66U

References · 4

• http://jvn.jp/en/jp/JVN32631078/index.html · Vendor Advisory
• http://asus.com/jp/News/PNzPd7vkXtrKWXHR · Vendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7270 · Security Note