CVE-2020-23648: asus rt-n12e_firmware

Vulnerability summary

CVE-2020-23648 is a high (CVSS 7.5) vulnerability in asus rt-n12e_firmware. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-10-2022
   PublishedVulnerability first disclosed.
2. 09-05-2025
   Last modifiedVulnerability information updated.

Description

Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can change the administrator password without any authentication.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.