Host HTTP Header Injection Vulnerability in Askey RTF8115VW Devices
CVE-2021-27404

6.1MEDIUM

Key Information:

Vendor
Asus
Status
Askey Rtf8115vw Firmware
Vendor
CVE Published:
19 February 2021

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 device is vulnerable to a host HTTP header injection. This vulnerability could allow an attacker to manipulate responses and conduct phishing attacks or redirect users to malicious sites. Proper validation mechanisms for HTTP headers are essential to safeguard against such attacks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-27404
Created by bokanrb

References

https://github.com/bokanrb/HostHeaderInjection-Askey
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.