Asus Router affected by multiple Vulnerabilities

guest · Jul 23, 2020

Two Security Vulnerabilities Found in Asus RT-AC1900P Router
July 23, 2020
https://www.ispreview.co.uk/index.p...bilities-found-in-asus-rt-ac1900p-router.html

Owners of the popular ASUS RT-AC1900P (RT-AC68U) broadband router should immediately visit the product’s support site to download and apply the latest firmware update, which comes after two new vulnerabilities were discovered that “could allow for complete compromise” of the device and all traffic that traverses it.

The router itself has been around for a number of years, but it remains one of the most popular thanks to its feature set and performance.
Click to expand...

The manufacturer, ASUS, was notified of these issues some time ago and has already patched them in their recent firmware (here). Suffice to say that now is a good time to update, given that the new vulnerabilities have been disclosed to the public.
Click to expand...

Trustwave: ASUS Router Vulnerable to Fake Updates and XSS (CVE-2020-15498 & CVE-2020-15499)

Recently ASUS patched two issues I discovered in the RT-AC1900P router firmware update functionality. These vulnerabilities could allow for complete compromise of the router and all traffic that traverses it.
Finding 1: Update Accepts Forged Server Certificates (CVE-2020-15498)
The first vulnerability was about accepting untrusted (forged) certificates by the wget program used by the router to fetch the updates from ASUS servers
Finding 2: XSS in Release Notes Dialog Window (CVE-2020-15499)
The second bug ASUS fixed was a cross-site scripting (XSS) vulnerability in the Web Management interface related to firmware updates: the release notes page did not properly escape the contents of the page before rendering it to the user.
Click to expand...

Rasheed187 · Jul 25, 2020

But what I wonder about, how hard would it be for a hacker to exploit this on a mass scale? That didn't become clear to me.

guest · Jan 12, 2023

Severe Vulnerabilities Allow Hacking of Asus Gaming Router
By Ionut Arghire - January 12, 2023

Cisco’s Talos security researchers have published technical information on three severe vulnerabilities impacting Asus RT-AX82U routers.
Click to expand...

A Wi-Fi 6 gaming router, the RT-AX82U can be configured via an HTTP server that is running on the local network, but also supports remote management and monitoring.

Last year, Cisco’s Talos researchers identified three critical- and high-severity security defects that could be exploited to bypass authentication, leak information, or cause a denial-of-service (DoS) condition on a vulnerable RT-AX82U router.
Click to expand...

The most severe of these bugs is CVE-2022-35401 (CVSS score of 9.0), an authentication bypass exploitable via a series of crafted HTTP requests. An attacker could exploit the vulnerability to gain full administrative access to a vulnerable device.
The remaining two vulnerabilities CVE-2022-38105 and CVE-2022-38393 are two high-severity bugs impacting router functionality allowing for a mesh network setup.

The three vulnerabilities were identified in Asus RT-AX82U firmware version 3.0.0.4.386_49674-ge182230 and were reported to the vendor in August. Users are advised to update their devices to the latest firmware release, which addresses all three bugs.
Click to expand...

Cisco Talos: Vulnerability Spotlight: Asus router access, information disclosure, denial of service vulnerabilities discovered

By Kri Dontje - January 10, 2023
Cisco Talos recently discovered three vulnerabilities in Asus router software.

The Asus RT-AX82U router is one of the newer Wi-Fi 6 (802.11ax)-enabled routers that also supports mesh networking with other Asus routers. Like other routers, it is configurable via an HTTP server running on the local network. However, it can also be configured to support remote administration and monitoring in more of an IOT style.
Click to expand...

Log in or Sign up

Asus Router affected by multiple Vulnerabilities

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

Asus Router affected by multiple Vulnerabilities

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches