critical9.0
CVE-2021-43702
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS).
Impact
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Asus | Zenwifi Xd4s Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Xt9 Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Xd5 Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Pro Et12 Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Pro Xt12 Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Ax Hybrid Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Et8 Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Xd6 Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Ac Mini Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Ax Mini Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Ax Firmware | Version 3.0.0.4.386.46061 |
| Asus | Zenwifi Ac Firmware | Version 3.0.0.4.386.46061 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/
- https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch
- https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/
- https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch