PT-2023-7246 · Asus · Asus Rt-Ac87U

Chuya Hayakawa · Published 2023-11-08 · Updated 2024-08-27 · CVE-2023-47678

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions ASUS RT-AC87U all versions

Description An improper access control issue exists, related to the implementation of the TFTP protocol, allowing an attacker to read or write files not intended for access. This can be achieved by connecting to the target device via TFTP. The vulnerability is associated with insufficient access control, enabling a remote attacker to access, modify, or delete files.

Recommendations For all versions of ASUS RT-AC87U, consider disabling TFTP access as a temporary workaround until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-275

CWE-284

Related Identifiers

BDU:2023-08274

CVE-2023-47678

Affected Products

Asus Rt-Ac87U

References · 10

• https://safe-surf.ru/upload/VULN-new/VULN.2023-11-29.1.pdf · Security Note
• https://bdu.fstec.ru/vul/2023-08274 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-47678 · Security Note
• https://t.me/cvenotify/60990 · Telegram Post
• https://jvn.jp/en/vu/JVNVU96079387 · Note
• https://t.me/cvenotify/88659 · Telegram Post
• https://asus.com/support · Note
• https://t.me/cvenotify/92381 · Telegram Post
• https://vuldb.com/ru/?id.245440 · Note
• https://asus.com/event/network/EOL-product · Note