CVE-2017-15655

CRITICAL

Asus asuswrt <= 3.0.0.4.376.X - Remote Code Execution via HTTPd Buffer Overflow

Title source: llm
STIX 2.1

Description

Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages.

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
http://sploit.tech/2018/01/16/ASUS-part-I.html
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2018/Jan/63

Scores

CVSS v3 9.6
EPSS 0.0144
EPSS Percentile 80.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (1)
asus/asuswrt < 3.0.0.4.378
Published Jan 31, 2018
Tracked Since Feb 18, 2026