Sign-up

ID

VAR-201809-0840


CVE

CVE-2018-17023


TITLE

ASUS GT-AC5300 Cross-Site Request Forgery Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2019-07080 // CNNVD: CNNVD-201809-652

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm. ASUS GT-AC5300 The router contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The ASUSGT-AC5300 is a wireless router from ASUS

Trust: 2.25

sources: NVD: CVE-2018-17023 // JVNDB: JVNDB-2018-009982 // CNVD: CNVD-2019-07080 // VULHUB: VHN-127441

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-07080

AFFECTED PRODUCTS

vendor:asusmodel:gt-ac5300scope:lteversion:3.0.0.4.384_32738

Trust: 1.0

vendor:asustek computermodel:gt-ac5300scope:lteversion:3.0.0.4.384_32738

Trust: 0.8

vendor:asusmodel:gt-ac5300 <=3.0.0.4.384 32738scope: - version: -

Trust: 0.6

vendor:asusmodel:gt-ac5300scope:eqversion:3.0.0.4.384_32738

Trust: 0.6

sources: CNVD: CNVD-2019-07080 // JVNDB: JVNDB-2018-009982 // CNNVD: CNNVD-201809-652 // NVD: CVE-2018-17023

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-17023
value: HIGH

Trust: 1.0

NVD: CVE-2018-17023
value: HIGH

Trust: 0.8

CNVD: CNVD-2019-07080
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201809-652
value: MEDIUM

Trust: 0.6

VULHUB: VHN-127441
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-17023
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-07080
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-127441
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-17023
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2019-07080 // VULHUB: VHN-127441 // JVNDB: JVNDB-2018-009982 // CNNVD: CNNVD-201809-652 // NVD: CVE-2018-17023

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-127441 // JVNDB: JVNDB-2018-009982 // NVD: CVE-2018-17023

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-652

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201809-652

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-009982

PATCH
title:ROG Rapture GT-AC5300url:https://www.asus.com/Networking/ROG-Rapture-GT-AC5300/HelpDesk_BIOS/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-009982

EXTERNAL IDS
db:NVDid:CVE-2018-17023
Trust: 3.1
db:JVNDBid:JVNDB-2018-009982
Trust: 0.8
db:CNVDid:CNVD-2019-07080
Trust: 0.6
db:CNNVDid:CNNVD-201809-652
Trust: 0.6
db:VULHUBid:VHN-127441
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-07080 // 
            
            
            
            VULHUB: VHN-127441 // 
            
            
            
            JVNDB: JVNDB-2018-009982 // 
            
            
            
            CNNVD: CNNVD-201809-652 // 
            
            
            
            NVD: CVE-2018-17023

REFERENCES
url:https://github.com/pagalaxylab/vulinfo/blob/master/asus/csrf_bypass_referer/asus%20gt-ac5300%20csrf%20bypass%20referer.md
Trust: 2.5
url:https://nvd.nist.gov/vuln/detail/cve-2018-17023
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17023
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2019-07080 // 
            
            
            
            VULHUB: VHN-127441 // 
            
            
            
            JVNDB: JVNDB-2018-009982 // 
            
            
            
            CNNVD: CNNVD-201809-652 // 
            
            
            
            NVD: CVE-2018-17023

SOURCES
db:CNVDid:CNVD-2019-07080
db:VULHUBid:VHN-127441
db:JVNDBid:JVNDB-2018-009982
db:CNNVDid:CNNVD-201809-652
db:NVDid:CVE-2018-17023

LAST UPDATE DATE
2024-11-23T23:12:03.099000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-07080date:2019-03-14T00:00:00
db:VULHUBid:VHN-127441date:2018-11-07T00:00:00
db:JVNDBid:JVNDB-2018-009982date:2018-12-03T00:00:00
db:CNNVDid:CNNVD-201809-652date:2018-09-14T00:00:00
db:NVDid:CVE-2018-17023date:2024-11-21T03:53:43.667

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-07080date:2019-03-13T00:00:00
db:VULHUBid:VHN-127441date:2018-09-13T00:00:00
db:JVNDBid:JVNDB-2018-009982date:2018-12-03T00:00:00
db:CNNVDid:CNNVD-201809-652date:2018-09-14T00:00:00
db:NVDid:CVE-2018-17023date:2018-09-13T19:29:00.993