Remote Information Disclosure Vulnerability in ASUS Routers
CVE-2018-18287

5.3MEDIUM

Key Information:

Vendor

Asus
Status
Rt-ac58u Firmware
Vendor
CVE Published:
14 October 2018

What is CVE-2018-18287?

The ASUS RT-AC58U device, running version 3.0.0.4.380_6516, is susceptible to a vulnerability that allows remote attackers to access sensitive information. By exploiting this weakness, attackers can extract hostnames and IP addresses from the dhcpLeaseInfo data, which is exposed in the HTML source code of the Main_Login.asp page. This can lead to unauthorized network reconnaissance and potential further attacks.

References

https://github.com/remix30303/AsusLeak
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.