ASUS vulnerabilities, page 4
357 vulnerabilities
Known vulnerabilities in ASUS products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 585 products.
CVE-2021-43702asus4g-ac53u_firmware+89
EPSS score0.98%
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.CVE-2021-27403asusaskey_rtf8115vw_firmwareEPSS score1.23%
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.CVE-2021-27404asusaskey_rtf8115vw_firmwareEPSS score0.87%
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header.CVE-2021-46247asuscmax6000_firmwareEPSS score1.18%
The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from ASUS CMAX6000 v1.02.00.CVE-2021-46109asusrt-ac52u_b1_firmwareEPSS score0.70%
Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack.CVE-2021-44158asusrt-ax56u_firmwareEPSS score0.68%
ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authenticated local area network attacker can launch arbitrary code execution to control the system or disrupt service.CVE-2021-45756asusrt-ac5300_firmware+1EPSS score1.24%
Asus RT-AC68U <3.0.0.4.385.20633 and RT-AC5300 <3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi.CVE-2021-45757asusrt-ac68u_firmwareEPSS score1.08%
ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS).CVE-2021-28200asusasmb9-ikvm_firmware+87EPSS score1.81%
The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28181asusasmb8-ikvm_firmware+5EPSS score1.81%
The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28184asusasmb8-ikvm_firmware+5EPSS score1.81%
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28187asusasmb8-ikvm_firmware+5EPSS score1.15%
The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28180asusasmb8-ikvm_firmware+5EPSS score1.81%
The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28685asusgputweak_iiEPSS score0.32%
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with physical memory (by calling one of several driver routines that map physical memory into the virtual address space of the calling process) and to interact with MSR registers. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges via a DeviceIoControl.CVE-2021-28179asusasmb8-ikvm_firmware+5EPSS score1.81%
The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28209asusasmb9-ikvm_firmware+87EPSS score1.90%
The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.CVE-2021-28195asusasmb9-ikvm_firmware+87EPSS score1.81%
The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28185asusasmb8-ikvm_firmware+5EPSS score1.81%
The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28194asusasmb9-ikvm_firmware+87EPSS score1.81%
The specific function in ASUS BMC’s firmware Web management page (Remote image configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.CVE-2021-28196asusasmb9-ikvm_firmware+87EPSS score1.15%
The specific function in ASUS BMC’s firmware Web management page (Generate SSL certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.