A vulnerability, which was classified as critical, has been found in Asus AsusWRT up to 3.0.0.4.380.7743. This issue affects an unknown functionality of the component HTTPd Server. The manipulation of the argument User-Agent as part of a Session Token leads to a session expiration vulnerability. Using CWE to declare the problem leads to CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized user to execute any action knowing administrator session token by using a specific User-Agent string.

The bug was discovered 01/14/2018. The weakness was presented 01/31/2018 as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2017-15653 since 10/19/2017. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 17 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-112675 and VDB-112676 for similar entries.

Productinfo

Vendor

• Asus

Name

• AsusWRT

Version

• 3.0.0.4.380.7743

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion