Vulnerability Description
Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Asus | Asuswrt | < 3.0.0.4.378 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-HiThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2018/Jan/63ExploitMailing ListThird Party Advisory
- http://sploit.tech/2018/01/16/ASUS-part-I.htmlExploitThird Party Advisory
- http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-HiThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2018/Jan/63ExploitMailing ListThird Party Advisory
- http://sploit.tech/2018/01/16/ASUS-part-I.htmlExploitThird Party Advisory
FAQ
What is CVE-2017-15655?
CVE-2017-15655 is a vulnerability with a CVSS score of 9.6 (CRITICAL). Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclo...
How severe is CVE-2017-15655?
CVE-2017-15655 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-15655?
Check the references section above for vendor advisories and patch information. Affected products include: Asus Asuswrt.