PT-2023-23221 · Asus · Asus Router Rt-Ax3000

Shungo Kumasaka · Published 2023-06-13 · Updated 2025-01-03 · CVE-2023-31195

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403

Description The issue arises from the use of sensitive cookies without the 'Secure' attribute. This allows an attacker, who can mount a man-in-the-middle attack, to potentially hijack a user's session if the user logs into the affected device through an unencrypted 'http' connection.

Recommendations For ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403, update to version 3.0.0.4.388.23403 or later to resolve the issue. As a temporary workaround, consider restricting access to the device through unencrypted connections to minimize the risk of session hijacking.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-31195

Affected Products

Asus Router Rt-Ax3000

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-31195 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31195 · Vendor Advisory
• https://t.me/cvenotify/106240 · Telegram Post
• https://jvn.jp/en/jp/JVN34232595 · Note
• https://t.me/true_secator/4523 · Telegram Post
• https://t.me/cvenotify/52169 · Telegram Post
• https://asus.com/networking-iot-servers/wifi-routers/asus-wifi-routers/rt-ax3000/helpdesk_bios/?model2Name=RT-AX3000 · Note
• https://t.me/cvenotify/52810 · Telegram Post