PT-2020-14460 · Gnu+1 · Wget+1

Published 2020-07-24 · Updated 2020-09-03 · CVE-2020-15498

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ASUS RT-AC1900P versions prior to 3.0.0.4.385 20253

Description An issue was discovered where the router accepts an arbitrary server certificate for a firmware update. This is due to the --no-check-certificate option being passed to the wget tool used to download firmware update files.

Recommendations For versions prior to 3.0.0.4.385 20253, update to version 3.0.0.4.385 20253 or later to resolve the issue. As a temporary workaround, consider disabling the firmware update feature until a patch is available. Restrict access to the firmware update module to minimize the risk of exploitation. Avoid using the wget tool with the --no-check-certificate option in the affected API endpoint until the issue is resolved.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-15498

Affected Products

Asus Rt-Ac1900P

Wget

References · 4

• https://osv.dev/vulnerability/CVE-2020-15498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15498 · Security Note
• https://t.me/cybersecuritytechnologies/1471 · Telegram Post
• https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=27440 · Note