High severity · published Dec 9, 2020
CVE-2020-29655
An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. Accessing Main_Login.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp will redirect to the login site, which will show the value of the parameter productname within the title. An attacker might be able to influence the appearance of the login page, aka text injection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rt-ac88u Firmware · Asus
before 3.1.0.108 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-29655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-29655
Third Party Advisory
https://vuldb.com/?id.165678
More from Rt-ac88u Firmware
9.8
CVE-2018-9285
Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices…
9.0
CVE-2021-43702
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS)
7.5
CVE-2021-3128
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that…
7.5
CVE-2020-29656
An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108