Details of VAR-202305-1464

ID

VAR-202305-1464

CVE

CVE-2023-28702

TITLE

ASUS RT-AC86U Operating System Command Injection Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2023-45449 // CNNVD: CNNVD-202306-094

DESCRIPTION

ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands, disrupt system or terminate service. ASUS RT-AC86U is a dual-band Wi-Fi router made by ASUS in China

Trust: 1.44

sources: NVD: CVE-2023-28702 // CNVD: CNVD-2023-45449

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2023-45449

AFFECTED PRODUCTS

vendor:	asus	model:	rt-ac86u	scope:	eq	version:	3.0.0.4.386.51255	Trust: 1.0
vendor:	asus	model:	rt-ac86u	scope:	eq	version:	v3.0.0.4.386.51255	Trust: 0.6

sources: CNVD: CNVD-2023-45449 // NVD: CVE-2023-28702

CVSS

SEVERITY

CVSSV2

CVSSV3

twcert@cert.org.tw:	CVE-2023-28702
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2023-45449
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202306-094
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2023-45449
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

twcert@cert.org.tw:	CVE-2023-28702
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2023-45449 // CNNVD: CNNVD-202306-094 // NVD: CVE-2023-28702

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.0

sources: NVD: CVE-2023-28702

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202306-094

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202306-094

PATCH

title:

url:

https://github.com/xxy1126/Vuln

Trust: 0.1

sources: VULMON: CVE-2023-28702

EXTERNAL IDS

db:	NVD	id:	CVE-2023-28702	Trust: 2.3
db:	CNVD	id:	CNVD-2023-45449	Trust: 0.6
db:	CNNVD	id:	CNNVD-202306-094	Trust: 0.6
db:	VULMON	id:	CVE-2023-28702	Trust: 0.1

sources: CNVD: CNVD-2023-45449 // VULMON: CVE-2023-28702 // CNNVD: CNNVD-202306-094 // NVD: CVE-2023-28702

REFERENCES

url:	https://www.twcert.org.tw/tw/cp-132-7146-ef92a-1.html	Trust: 2.2
url:	https://cxsecurity.com/cveshow/cve-2023-28702/	Trust: 0.6
url:	https://github.com/xxy1126/vuln	Trust: 0.1

sources: CNVD: CNVD-2023-45449 // VULMON: CVE-2023-28702 // CNNVD: CNNVD-202306-094 // NVD: CVE-2023-28702

SOURCES

db:	CNVD	id:	CNVD-2023-45449
db:	VULMON	id:	CVE-2023-28702
db:	CNNVD	id:	CNNVD-202306-094
db:	NVD	id:	CVE-2023-28702

LAST UPDATE DATE

2024-08-14T14:10:03.574000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2023-45449	date:	2023-06-09T00:00:00
db:	CNNVD	id:	CNNVD-202306-094	date:	2023-06-05T00:00:00
db:	NVD	id:	CVE-2023-28702	date:	2023-06-09T18:21:46.873

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2023-45449	date:	2023-06-09T00:00:00
db:	CNNVD	id:	CNNVD-202306-094	date:	2023-06-02T00:00:00
db:	NVD	id:	CVE-2023-28702	date:	2023-06-02T11:15:10.510