ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Cross-Site Scripting

CVE编号

CVE-2017-6547

利用情况

暂无

补丁情况

N/A

披露时间

2017-03-09

漏洞描述

Cross-site scripting (XSS) vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before 3.0.0.4.380.7378; RT-AC68W routers with firmware before 3.0.0.4.380.7266; and RT-N600, RT-N12+ B1, RT-N11P B1, RT-N12VP B1, RT-N12E C1, RT-N300 B1, and RT-N12+ Pro routers with firmware before 3.0.0.4.380.9488 allows remote attackers to inject arbitrary JavaScript by requesting filenames longer than 50 characters.

解决建议

暂无临时解决方案

参考链接
http://www.securityfocus.com/bid/96938
https://bierbaumer.net/security/asuswrt/#cross-site-scripting-xss
https://www.exploit-db.com/exploits/41571/

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	系统	asus	rt-ac53_firmware	3.0.0.4.380.6038	-
	运行在以下环境
	硬件	asus	rt-ac53	-	-

CVSS3评分 6.1

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 已更改
• 用户交互 需要
• 可用性 无
• 保密性 低
• 完整性 低

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CWE-ID 漏洞类型 CWE-79 在Web页面生成时对输入的转义处理不恰当（跨站脚本）