CVE-2017-14698 ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allo...
CriticalCVSS 9.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote attackers to change passwords of arbitrary users via the http_passwd parameter to mod_login.asp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ASUS dsl-ac51 firmware | All versions | No fix listed |
| ASUS dsl-ac52u firmware | All versions | No fix listed |
| ASUS dsl-ac55u firmware | All versions | No fix listed |
| ASUS dsl-n55u c1 firmware | All versions | No fix listed |
| ASUS dsl-n55u d1 firmware | All versions | No fix listed |
| ASUS dsl-ac56u firmware | All versions | No fix listed |
| ASUS dsl-n10 c1 firmware | All versions | No fix listed |
| ASUS dsl-n12u c1 firmware | All versions | No fix listed |
| ASUS dsl-n12e c1 firmware | All versions | No fix listed |
| ASUS dsl-n14u firmware | All versions | No fix listed |
| ASUS dsl-n14u-b1 firmware | All versions | No fix listed |
| ASUS dsl-n16 firmware | All versions | No fix listed |
| ASUS dsl-n16u firmware | All versions | No fix listed |
| ASUS dsl-n17u firmware | All versions | No fix listed |
| ASUS dsl-n66u firmware | All versions | No fix listed |
| ASUS dsl-ac750 firmware | All versions | No fix listed |
References
- www.asus.com patch vendor-advisory
- www.securityartwork.es broken-link