CVE-2017-14699

Published: Jan 29, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote authenticated users to read arbitrary files via a crafted DTD in (1) an UPDATEACCOUNT or (2) a PROPFIND request.

Affected (16)

Products: Asus: Dsl Ac51 Firmware, Dsl Ac52u Firmware, Dsl Ac55u Firmware, Dsl N55u C1 Firmware, Dsl N55u D1 Firmware, Dsl Ac56u Firmware, Dsl N10 C1 Firmware, Dsl N12u C1 Firmware, Dsl N12e C1 Firmware, Dsl N14u Firmware, Dsl N14u B1 Firmware, Dsl N16 Firmware, Dsl N16u Firmware, Dsl N17u Firmware, Dsl N66u Firmware, Dsl Ac750 Firmware

16 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac51 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac51	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac52u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac52u	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac55u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac55u	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N55u C1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N55u C1	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N55u D1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N55u D1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac56u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac56u	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N10 C1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N10 C1	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N12u C1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N12u C1	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N12e C1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N12e C1	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N14u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N14u	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N14u B1 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N14u B1	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N16 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N16	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N16u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N16u	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N17u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N17u	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl N66u Firmware	All versions

Running on/with	Platform Versions
Asus Dsl N66u	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Dsl Ac750 Firmware	All versions

Running on/with	Platform Versions
Asus Dsl Ac750	All versions

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (4)

https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/

Source: cve@mitre.org

PatchVendor Advisory

https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers/

Source: cve@mitre.org

Broken Link

https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.