SB2023090617 - Multiple vulnerabilities in ASUS Routers

Main Vulnerability Database SB2023090617

SB2023090617 - Multiple vulnerabilities in ASUS Routers

Published: September 6, 2023

Security Bulletin ID SB2023090617

Severity

High

Patch available

YES

Number of vulnerabilities 8

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) Command Injection (CVE-ID: CVE-2023-38031)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web browsing history function. A remote user can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Command Injection (CVE-ID: CVE-2023-38032)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the security-related function of AiProtection. A remote user can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Command Injection (CVE-ID: CVE-2023-38033)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the wanStat_detail function. A remote user can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Command Injection (CVE-ID: CVE-2023-39236)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the statistical value function. A remote user can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

5) Command Injection (CVE-ID: CVE-2023-39237)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the application analysis function. A remote user can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

6) Format string error (CVE-ID: CVE-2023-39238)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a format string error in the iperf-related modules set_iperf3_svr.cgi API. A remote attacker can supply a specially crafted input that contains format string specifiers and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

7) Format string error (CVE-ID: CVE-2023-39239)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a format string error in the API of the general setting function. A remote attacker can supply a specially crafted input that contains format string specifiers and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

8) Format string error (CVE-ID: CVE-2023-39240)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a format string error in the iperf-related modules set_iperf3_cli.cgi API. A remote attacker can supply a specially crafted input that contains format string specifiers and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References