Asus WL-330NUL up to 3.0.0.41 WPA2-PSK information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in Asus WL-330NUL up to 3.0.0.41. Affected is an unknown function of the component WPA2-PSK. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2015-7787. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Asus WL-330NUL up to 3.0.0.41. It has been rated as problematic. This issue affects some unknown functionality of the component WPA2-PSK. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vectors.

The weakness was released 12/30/2015 (Website). It is possible to read the advisory at asus.com. The identification of this vulnerability is CVE-2015-7787 since 10/09/2015. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 3.0.0.42 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-79992, VDB-79993 and VDB-79994. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Asus

Name

• WL-330NUL

Version

• 3.0.0.0
• 3.0.0.1
• 3.0.0.2
• 3.0.0.3
• 3.0.0.4
• 3.0.0.5
• 3.0.0.6
• 3.0.0.7
• 3.0.0.8
• 3.0.0.9
• 3.0.0.10
• 3.0.0.11
• 3.0.0.12
• 3.0.0.13
• 3.0.0.14
• 3.0.0.15
• 3.0.0.16
• 3.0.0.17
• 3.0.0.18
• 3.0.0.19
• 3.0.0.20
• 3.0.0.21
• 3.0.0.22
• 3.0.0.23
• 3.0.0.24
• 3.0.0.25
• 3.0.0.26
• 3.0.0.27
• 3.0.0.28
• 3.0.0.29
• 3.0.0.30
• 3.0.0.31
• 3.0.0.32
• 3.0.0.33
• 3.0.0.34
• 3.0.0.35
• 3.0.0.36
• 3.0.0.37
• 3.0.0.38
• 3.0.0.39
• 3.0.0.40
• 3.0.0.41

License

• commercial

Website

• Vendor: https://www.asus.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion