XML External Entity Vulnerabilities in ASUS DSL Routers
CVE-2017-14699

6.5MEDIUM

Key Information:

Vendor

Asus
Status
Dsl-ac51 Firmware
Vendor
CVE Published:
29 January 2018

What is CVE-2017-14699?

The AiCloud feature present in several ASUS DSL routers is susceptible to multiple XML External Entity (XXE) vulnerabilities. These issues allow remote authenticated users to exploit the routers by sending crafted Document Type Definitions (DTD) in specific requests. By leveraging these vulnerabilities in an UPDATEACCOUNT or PROPFIND request, attackers can read arbitrary files on the system, potentially exposing sensitive information and impacting the integrity and confidentiality of the device's operation.

References

https://www.securityartwork.es/2018/01/25/some-vulnerabil...
x_refsource_MISC
https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.