Details of VAR-202012-0961

ID

VAR-202012-0961

CVE

CVE-2020-29655

TITLE

ASUS RT-AC88U injection vulnerability

Trust: 1.2

sources: CNVD: CNVD-2020-70962 // CNNVD: CNNVD-202012-783

DESCRIPTION

An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. Accessing Main_Login.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp will redirect to the login site, which will show the value of the parameter productname within the title. An attacker might be able to influence the appearance of the login page, aka text injection. ASUS RT-AC88U is a wireless router made by ASUS in China. The vulnerability originates from Main_Login.asp?flag=1＆productname=FOOBAR＆url=/downloadmaster/task.asp without filtering user input. Attackers can use this vulnerability to inject malicious Code and execute

Trust: 2.16

sources: NVD: CVE-2020-29655 // JVNDB: JVNDB-2020-014092 // CNVD: CNVD-2020-70962

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-70962

AFFECTED PRODUCTS

vendor:	asus	model:	rt-ac88u	scope:	lt	version:	3.1.0.108	Trust: 1.6
vendor:	asustek computer	model:	rt-ac88u	scope:	eq	version:	-	Trust: 0.8
vendor:	asustek computer	model:	rt-ac88u	scope:	eq	version:	rt-ac88u firmware 3.1.0.108	Trust: 0.8

sources: CNVD: CNVD-2020-70962 // JVNDB: JVNDB-2020-014092 // NVD: CVE-2020-29655

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-29655
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-29655
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-70962
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202012-783
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-29655
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-70962
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-29655
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2020-29655
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-70962 // JVNDB: JVNDB-2020-014092 // CNNVD: CNNVD-202012-783 // NVD: CVE-2020-29655

PROBLEMTYPE DATA

problemtype:	CWE-74	Trust: 1.0
problemtype:	injection (CWE-74) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-014092 // NVD: CVE-2020-29655

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202012-783

TYPE

injection

Trust: 0.6

sources: CNNVD: CNNVD-202012-783

PATCH

title:	top page	url:	https://www.asus.com/jp/	Trust: 0.8
title:	Patch for ASUS RT-AC88U injection vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/242020	Trust: 0.6
title:	ASUS RT-AC88U Repair measures for injecting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=136914	Trust: 0.6

sources: CNVD: CNVD-2020-70962 // JVNDB: JVNDB-2020-014092 // CNNVD: CNNVD-202012-783

EXTERNAL IDS

db:	NVD	id:	CVE-2020-29655	Trust: 3.0
db:	VULDB	id:	165678	Trust: 3.0
db:	JVNDB	id:	JVNDB-2020-014092	Trust: 0.8
db:	CNVD	id:	CNVD-2020-70962	Trust: 0.6
db:	CNNVD	id:	CNNVD-202012-783	Trust: 0.6

sources: CNVD: CNVD-2020-70962 // JVNDB: JVNDB-2020-014092 // CNNVD: CNNVD-202012-783 // NVD: CVE-2020-29655

REFERENCES

url:	https://vuldb.com/?id.165678	Trust: 3.0
url:	https://nvd.nist.gov/vuln/detail/cve-2020-29655	Trust: 1.4

sources: CNVD: CNVD-2020-70962 // JVNDB: JVNDB-2020-014092 // CNNVD: CNNVD-202012-783 // NVD: CVE-2020-29655

SOURCES

db:	CNVD	id:	CNVD-2020-70962
db:	JVNDB	id:	JVNDB-2020-014092
db:	CNNVD	id:	CNNVD-202012-783
db:	NVD	id:	CVE-2020-29655

LAST UPDATE DATE

2024-11-23T22:11:10.615000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-70962	date:	2020-12-13T00:00:00
db:	JVNDB	id:	JVNDB-2020-014092	date:	2021-07-27T02:24:00
db:	CNNVD	id:	CNNVD-202012-783	date:	2020-12-16T00:00:00
db:	NVD	id:	CVE-2020-29655	date:	2024-11-21T05:24:21.860

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-70962	date:	2020-12-13T00:00:00
db:	JVNDB	id:	JVNDB-2020-014092	date:	2021-07-27T00:00:00
db:	CNNVD	id:	CNNVD-202012-783	date:	2020-12-09T00:00:00
db:	NVD	id:	CVE-2020-29655	date:	2020-12-09T08:15:10.957