ASUS Critical Router Vulnerabilities Let Attackers Execute Arbitrary Code

June 21, 2023

ASUS has recently released a security advisory in which several ASUS critical router vulnerabilities have been fixed. The vulnerabilities were found to affect multiple ASUS routers with CVEs.

The company has recommended its users upgrade to the latest version of firmware to fix these router vulnerabilities.

CVE(s) of ASUS critical Router Vulnerabilities:

ASUS has fixed around 9 CVEs, as reported in the security advisory. The recent one was found to be CVE-2023-28702, and the oldest one was CVE-2018-1160.

CVECVSS ScoreCVSS VectorDescriptionCVE-2023-287028.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCommand Injection due to unsanitized parameters in specific web URLsCVE-2023-287037.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOut of Bounds Write due to insufficient validation of network packet headerCVE-2023-31195N/AN/AMan-In-the-Middle attack due to insecure Cookie attributeCVE-2022-468718.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOutdated Library (libusrsctp) exploitationCVE-2022-381057.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOut-of-bounds read leads to denial of serviceCVE-2022-354018.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAuthentication bypass due to expired keyCVE-2018-11609.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOut of bounds write in dsi_opensess.c in Netatalk leads to arbitrary code execution CVE-2022-383937.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOut-of-bounds read leads to denial of serviceCVE-2022-263769.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HBounds writing leads to memory corruption

Affected Products:

The list of routers affected by these CVE(s) includes,

GT6

GT-AXE16000

GT-AXE11000 PRO

GT-AXE11000

GT-AX6000

GT-AX11000

GS-AX5400

GS-AX3000

ZenWiFi XT9

ZenWiFi XT8

ZenWiFi XT8_V2

RT-AX86U PRO

RT-AX86U

RT-AX86S

RT-AX82U

RT-AX58U

RT-AX3000

TUF-AX6000

TUF-AX5400

ASUS has recommended all of its users patch their routers to prevent attackers.

If upgrading is not required or might affect your configurations, turning off the vulnerable services is recommended.

Looking For an All-in-One Multi-OS Patch Management Platform – Try Patch Manager Plus

The post ASUS Critical Router Vulnerabilities Let Attackers Execute Arbitrary Code appeared first on Cyber Security News.

Cyber Security News

New iShutdown Method Exposes Hidden Spyware Like Pegasus on Your iPhone

Cybersecurity researchers have identified a "lightweight method" called iShutdown for reliably identifying signs of spyware on Apple iOS devices, including notorious threats like NSO Group’s Pegasus, QuaDream’s Reign, and Intellexa’s Predator. 
Kaspersky, which analyzed a set of iPhones that were compromised with Pegasus, said the infections left traces in a file Read More

The Hacker News | #1 Trusted Cybersecurity News Site

Microsoft rolls out Recall to Windows Insiders with Copilot+ PCs

Microsoft announced today that its controversial AI-powered Recall feature is finally rolling out to Windows Insiders in the Dev Channel using Snapdragon-powered Copilot+ PCs. […] Read More

Tor Browser 14.0 Released: What’s New?

The Tor Project has announced the release of Tor Browser 14.0, marking a significant update to this privacy-focused web browser.

This release is based on Mozilla Firefox ESR 128, incorporating a year’s worth of upstream changes from Firefox, and includes numerous enhancements for both desktop and Android users.

Tor Browser 14.0 is the first stable release based on Firefox ESR 128. The transition involved a comprehensive audit of over 200 Bugzilla issues to ensure that privacy and security remain uncompromised.

Users will notice design updates inherited from Firefox, such as heavier typography and adjusted line heights, which aim to improve font compatibility and accessibility.

The new version improves the usability and compatibility of fingerprinting protections, enabling features like picture-in-picture and screenshots without compromising user privacy.

National Cybersecurity Awareness Month Cyber Challenges – Test your Skills Now

These improvements are part of ongoing efforts to maintain robust defenses against tracking and surveillance while enhancing user experience.

Android Enhancements

For Android users, Tor Browser 14.0 introduces a new feature allowing users to request a “New circuit for this site” directly from the browser’s menu.

New Android circuit

This replaces the previous “New identity” feature accessed via Android’s notification drawer, providing a more targeted approach to resolving connectivity issues with specific websites.

Initially, Tor Browser 13.5 was set to be the last version supporting Windows 7, 8, 8.1, and macOS 10.12-10.14.

browser versions supported

However, Tor Browser 14.0 extends support for these platforms temporarily, ensuring they continue to receive critical security updates until at least March 2025. This decision aligns with Mozilla’s extended support timeline for Firefox ESR 115.

Despite its advancements, Tor Browser 14.0 has some known issues:

Android Users: Those using Guardian Project’s F-Droid repository may face update delays due to ongoing issues since version 13.5.3. Users can alternatively download the APK directly from the Tor website or use Google Play for updates.

Windows Compatibility Mode: Users running Tor Browser in compatibility mode on Windows 10 or 11 might encounter issues where the system misidentifies as Windows 7, affecting updates to version 14.0.

The development of Tor Browser is a community-driven effort, with significant contributions from volunteers who tackle bugs and enhance features across platforms. The Tor Project acknowledges these contributions as vital to its mission of providing secure and private internet access.

Tor Browser 14.0 represents a major step forward in enhancing user privacy and security while improving usability across devices. With its updated design, enhanced features, and continued support for legacy systems, it remains a crucial tool for those seeking anonymity online.

Users are encouraged to download the latest version from the official Tor website and consider contributing to the project through feedback or donations, especially as all donations are matched until the end of the year.

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Watch Here

The post Tor Browser 14.0 Released: What’s New? appeared first on Cyber Security News.

CVE(s) of ASUS critical Router Vulnerabilities:

Affected Products:

Related

Related Posts