PT-2015-5828 · Asus · Asus Rt-G32

Mustlive · Published 2015-03-23 · Updated 2016-12-03 · CVE-2015-2676

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ASUS RT-G32 routers versions 2.0.2.6 through 2.0.3.2

Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that change the administrator password via a request to "start apply.htm".

Recommendations For version 2.0.2.6, update the firmware to a version that is not affected by this issue. For version 2.0.3.2, update the firmware to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the "start apply.htm" endpoint to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-2676

Affected Products

Asus Rt-G32

References · 5

• 🔥 http://websecurity.com.ua/7644 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Mar/42 · Exploit
• 🔥 http://packetstormsecurity.com/files/130724/ASUS-RT-G32-Cross-Site-Request-Forgery-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2676 · Security Note
• http://securityfocus.com/bid/73294 · Note