PT-2021-7659 · Asus · Asus Rt-Ac68U

Published 2021-01-18 · Updated 2025-03-26 · CVE-2021-37315

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUS RT-AC68U router firmware versions prior to 3.0.0.4.386.41634

Description The issue is related to an Incorrect Access Control problem in the Cloud Disk feature of the ASUS RT-AC68U router firmware. This problem allows remote attackers to write arbitrary files to the system due to improper sanitation of the source for COPY and MOVE operations. The vulnerability exists because of incomplete cleanup of temporary resources, which can be exploited by a remote attacker to record arbitrary files in the system.

Recommendations For versions prior to 3.0.0.4.386.41634, update the firmware to version 3.0.0.4.386.41634 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cloud Disk feature until the update is applied. Avoid using the COPY and MOVE operations in the Cloud Disk feature until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-459

CWE-706

Related Identifiers

BDU:2023-01050

CVE-2021-37315

Affected Products

Asus Rt-Ac68U

References · 5

• 🔥 https://robertchen.cc/blog/2021/03/31/asus-rce · Exploit
• https://bdu.fstec.ru/vul/2023-01050 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37315 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37315 · Vendor Advisory
• https://t.me/cvenotify/116428 · Telegram Post