ASUS Router 'infosvr' Remote Command Execution

critical Nessus Plugin ID 80518

Language:

Synopsis

The remote device contains a backdoor.

Description

The remote device is an ASUS router that contains firmware which is affected by a flaw in its 'infosvr' service due to not properly checking the MAC address of a request. An unauthenticated, remote attacker, using a crafted request to UDP port 9999, can exploit this to run arbitrary commands or access configuration details (including passwords) on the device.

Solution

Contact the device vendor regarding the availability of an update.

Plugin Details

Severity: Critical

ID: 80518

File Name: asuswrt_infosvr_command_exec.nasl

Version: 1.9

Type: remote

Family: Backdoors

Published: 1/14/2015

Updated: 11/25/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 9.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/o:asus:rt-ac66u_firmware, cpe:/o:asus:rt-n66u_firmware

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 1/4/2015

Exploitable With

Metasploit (ASUS infosvr Auth Bypass Command Execution)

Reference Information

CVE: CVE-2014-9583

BID: 71889

Detections

Analytics