CVE-2017-14698

Published: Jan 29, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote attackers to change passwords of arbitrary users via the http_passwd parameter to mod_login.asp.

Affected (16)

Products: Asus: Dsl Ac51 Firmware, Dsl Ac52u Firmware, Dsl Ac55u Firmware, Dsl N55u C1 Firmware, Dsl N55u D1 Firmware, Dsl Ac56u Firmware, Dsl N10 C1 Firmware, Dsl N12u C1 Firmware, Dsl N12e C1 Firmware, Dsl N14u Firmware, Dsl N14u B1 Firmware, Dsl N16 Firmware, Dsl N16u Firmware, Dsl N17u Firmware, Dsl N66u Firmware, Dsl Ac750 Firmware

16 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac51 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac51	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac52u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac52u	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac55u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac55u	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N55u C1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N55u C1	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N55u D1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N55u D1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac56u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac56u	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N10 C1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N10 C1	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N12u C1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N12u C1	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N12e C1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N12e C1	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N14u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N14u	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N14u B1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N14u B1	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N16 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N16	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N16u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N16u	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N17u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N17u	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N66u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N66u	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac750 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac750	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/

Source: cve@mitre.org

PatchVendor Advisory

https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers/

Source: cve@mitre.org

Broken Link

https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.