Buffer Overflow Vulnerabilities in Asuswrt HTTPd Server by Asus
CVE-2017-15655

9.6CRITICAL

Key Information:

Vendor

Asus
Status
Asuswrt
Vendor
CVE Published:
31 January 2018

What is CVE-2017-15655?

Multiple buffer overflow vulnerabilities in the HTTPd server of Asus routers running Asuswrt versions up to 3.0.0.4.376.X can lead to remote code execution with administrator privileges. This issue arises when the administrator interacts with certain pages. Although they have been addressed in subsequent releases, older models and those at end-of-life status remain exposed, posing significant risk to network security.

References

http://sploit.tech/2018/01/16/ASUS-part-I.html
x_refsource_MISC
http://seclists.org/fulldisclosure/2018/Jan/63
mailing-listx_refsource_FULLDISC
http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0...
x_refsource_MISC

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.