CVE-2016-6558CWE-77

CVE-2016-6558: falha em ASUS RP-AC52 Access Point

The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar RP-AC52 Access Point

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 3.5%
A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifically in the action_script parameter. The action_script parameter specifies a script to be executed if the action_mode parameter does not contain a valid state. If the input provided by action_script does not match one of the hard coded options, then it will be executed as the argument of either a system() or an eval() call allowing arbitrary commands to be executed.
Produtos afetados
ASUS · RP-AC52 Access Point
CVEs relacionadas — ASUS RP-AC52 Access Point

No mesmo produto, das mais perigosas para as menos.

CVE-2016-6557—The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to cross-site request forgeryEPSS 0.8%