CVE-2017-11345 in RT-AC68P
Summary
by MITRE
Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by hosting a crafted device description XML document (that includes a serviceType element) at a URL specified within a Location header in an SSDP response.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2019
The vulnerability CVE-2017-11345 represents a critical stack buffer overflow flaw in the networkmap component of Asuswrt-Merlin firmware affecting numerous ASUS router models. This vulnerability resides within the handling of device description XML documents, specifically when processing the serviceType element within SSDP (Simple Service Discovery Protocol) responses. The flaw allows remote attackers to execute arbitrary code on affected devices by manipulating network discovery mechanisms, making it particularly dangerous as it can be exploited without requiring local access or authentication.
The technical implementation of this vulnerability stems from improper input validation within the networkmap functionality that processes SSDP responses. When a router receives an SSDP response containing a Location header pointing to a malicious XML document, the firmware fails to properly bounds-check the serviceType element data during parsing. This allows an attacker to overflow the stack buffer and potentially overwrite critical memory locations, leading to arbitrary code execution. The vulnerability is classified under CWE-121 Stack-based Buffer Overflow, which is a well-known weakness category that affects memory management in software applications. The attack vector leverages the standard SSDP discovery mechanism used by devices to announce services on local networks, making exploitation straightforward and potentially widespread.
From an operational impact perspective, this vulnerability poses significant risks to network security as it enables remote code execution on affected routers without requiring any credentials or physical access. Attackers can leverage this vulnerability to gain full control over the affected devices, potentially leading to complete network compromise. The exploitation allows for persistent access to the network infrastructure, enabling various malicious activities including man-in-the-middle attacks, DNS hijacking, traffic interception, and establishing backdoors. The widespread deployment of affected ASUS router models across residential and enterprise networks amplifies the potential impact, as these devices often serve as primary network gateways and security perimeters.
The attack scenario begins with an attacker setting up a malicious network infrastructure that responds to SSDP discovery requests with crafted responses containing malicious XML documents. When an affected router processes these responses, it automatically attempts to retrieve and parse the device description XML, triggering the buffer overflow condition. The vulnerability affects a broad range of ASUS router models including the RT-AC5300, RT-AC68U, RT-AC88U, and numerous others, indicating a systemic issue within the firmware implementation. Mitigation strategies should include immediate firmware updates from ASUS, network segmentation to isolate affected devices, and monitoring for unusual SSDP traffic patterns. Network administrators should also implement firewall rules to restrict SSDP traffic between internal networks and external sources, as outlined in various security frameworks including the MITRE ATT&CK matrix for network discovery and lateral movement techniques. The vulnerability underscores the importance of proper input validation and memory management in embedded network devices, particularly those handling network discovery protocols that are inherently designed to be accessible from external networks.