PT-2024-4603 · Asus · Asus Rt-N12+ B1

Published 2024-03-08 · Updated 2024-11-04 · CVE-2024-28327

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ASUS RT-N12+ B1 router version not specified

Description: The issue is related to inadequate protection of registration data in the router's firmware, allowing local attackers to obtain unauthorized access and modify router settings. This is because the router stores user passwords in plaintext.

Recommendations: For the ASUS RT-N12+ B1 router, consider changing the administrator password and any other passwords stored on the device to minimize the risk of exploitation. As a temporary workaround, restrict local access to the router until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-310

CWE-312

Related Identifiers

BDU:2024-05111

CVE-2024-28327

Affected Products

Asus Rt-N12+ B1

References · 11

• 🔥❌ https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/Insecure-Credential-Storage-CVE%E2%80%902024%E2%80%9028327 · Exploit, Deleted
• 🔥❌ https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/Credentials-Stored-in-Cleartext-CVE%E2%80%902024%E2%80%9028327 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-28327 · Security Note
• https://bdu.fstec.ru/vul/2024-05111 · Security Note
• https://twitter.com/VulmonFeeds/status/1783961798145687667 · Twitter Post
• https://t.me/cvenotify/78193 · Telegram Post
• https://twitter.com/CVEnew/status/1783937496566374779 · Twitter Post
• https://vuldb.com/sv/?id.262199 · Note
• https://incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-28327 · Note
• http://asus.com · Note
• https://t.me/cvenotify/78203 · Telegram Post