PT-2022-11888 · Asus · Asus Rt-A88U

Luke Walker · Published 2022-07-05 · Updated 2022-07-18 · CVE-2021-43702

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASUS RT-A88U version 3.0.0.4.386 45898

Description The ASUS router admin panel does not sanitize the WiFi logs correctly. If an attacker is able to change the SSID of the router with a custom payload, they could achieve stored Cross Site Scripting (XSS) on the device.

Recommendations For version 3.0.0.4.386 45898, consider restricting access to the admin panel and avoid using custom SSID names until a patch is available. As a temporary workaround, disabling the WiFi logs or limiting their accessibility can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43702

Affected Products

Asus Rt-A88U

References · 6

• 🔥 https://kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch · Exploit
• https://osv.dev/vulnerability/CVE-2021-43702 · Vendor Advisory
• https://asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43702 · Security Note
• https://t.me/cibsecurity/45581 · Telegram Post
• https://t.me/cvenotify/32594 · Telegram Post