Published: 08/01/2015 Updated: 27/04/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Subscribe to Tm-ac1900

common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote malicious users to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999. NOTE: this issue was incorrectly mapped to CVE-2014-10000, but that ID is invalid due to its use as an example of the 2014 CVE ID syntax change.

Vulnerable Product	Search on Vulmon	Subscribe to Product
t-mobile tm-ac1900 3.0.0.4.376_3169
asus wrt_firmware 3.0.0.4.376.2524-g0012f52
asus wrt_firmware 3.0.0.4.376_1071

AsusWRT Router versions prior to 30043807743 suffer from an unauthenticated LAN remote code execution vulnerability ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Udp def initialize(info = {}) super(update_info(info, 'Name' => 'ASUS infosvr Aut ...

#!/usr/bin/env python3 # Exploit Title: ASUSWRT 3004376_1071 LAN Backdoor Command Execution # Date: 2014-10-11 # Vendor Homepage: wwwasuscom/ # Software Link: dlcdnetasuscom/pub/ASUS/wireless/RT-N66U_B1/FW_RT_N66U_30043762524zip # Source code: dlcdnetasuscom/pub/ASUS/wireless/RT-N66U_B1/GPL_RT_N66U_30043762524zip # ...

ASUS Router infosvr UDP Broadcast root Command Execution

ASUS Router infosvr UDP Broadcast root Command Execution Several models of ASUS's routers include a service called infosvr that listens on UDP broadcast port 9999 on the LAN or WLAN interface It's used by one of ASUS's tools to ease router configuration by automatically locating routers on the local subnet This service runs with root privileges and contains an

CWE-264 https://github.com/jduck/asus-cmd http://www.exploit-db.com/exploits/35688 http://packetstormsecurity.com/files/129815/ASUSWRT-3.0.0.4.376_1071-LAN-Backdoor-Command-Execution.html https://support.t-mobile.com/docs/DOC-21994 https://www.exploit-db.com/exploits/44524/https://nvd.nist.gov https://github.com/jduck/asus-cmd https://packetstormsecurity.com/files/146102/AsusWRT-Router-Remote-Code-Execution.html https://www.exploit-db.com/exploits/44524/

CVE-2014-9583

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect