Cross-Site Scripting Vulnerability in ASUS GT-AC5300 Devices
CVE-2018-17021

6.1MEDIUM

Key Information:

Vendor
Asus
Status
Gt-ac5300 Firmware
Vendor
CVE Published:
13 September 2018

Summary

A Cross-Site Scripting (XSS) vulnerability exists in ASUS GT-AC5300 devices running firmware versions prior to 3.0.0.4.384_32738. This flaw allows remote attackers to exploit the appGet.cgi hook parameter, enabling them to inject arbitrary web scripts or HTML. The exploitation of this vulnerability can lead to unauthorized actions being executed on behalf of users, potentially compromising the security and integrity of user data.

References

https://github.com/PAGalaxyLab/VulInfo/blob/master/ASUS/a...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.