CVE-2025-1354 in RT-N12E
Summary
by MITRE • 02/16/2025
A vulnerability was found in Asus RT-N12E 2.0.0.19. It has been classified as problematic. Affected is an unknown function of the file sysinfo.asp. The manipulation of the argument SSID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/13/2025
The vulnerability identified as CVE-2025-1354 represents a critical cross-site scripting flaw discovered in the Asus RT-N12E router firmware version 2.0.0.19. This issue resides within the sysinfo.asp file and specifically targets the SSID argument handling mechanism, creating a significant security risk for affected network infrastructure. The vulnerability classification as "problematic" indicates a substantial threat level that requires immediate attention from network administrators and security professionals managing these devices.
The technical exploitation of this vulnerability occurs through manipulation of the SSID parameter within the sysinfo.asp file, which allows attackers to inject malicious scripts into the router's web interface. This cross-site scripting vulnerability enables attackers to execute arbitrary code within the context of the victim's browser session, potentially compromising the router's administrative interface and gaining unauthorized access to network configuration settings. The attack vector is particularly concerning as it can be launched remotely without requiring physical access to the device, making it accessible to threat actors worldwide.
The operational impact of this vulnerability extends beyond simple script execution, as it can lead to complete compromise of the affected router's administrative functions. An attacker could potentially modify network settings, redirect traffic through malicious servers, or establish persistent access points within the network infrastructure. This vulnerability directly aligns with CWE-79, which describes cross-site scripting flaws in web applications, and represents a clear violation of secure coding practices that should prevent user input from being directly embedded into web responses without proper sanitization.
Network administrators should immediately implement mitigations including firmware updates from Asus if available, network segmentation to isolate affected devices, and monitoring for suspicious activity in router management interfaces. The fact that this exploit has been publicly disclosed and is potentially in use increases the urgency of remediation efforts. Organizations should consider implementing web application firewalls to detect and block malicious requests targeting this specific vulnerability, while also conducting comprehensive network audits to identify all affected devices and ensure proper patch management protocols are in place. The lack of vendor response to early disclosure attempts highlights the importance of proactive security measures and the need for organizations to maintain their own security monitoring capabilities when vendor support is unavailable.