Critical severity · published Jul 5, 2022
CVE-2021-43702
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS)
9.0
CVSS
1%
EPSS
No
On KEV
Description
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RR
Rog Rapture Gt-ac2900 Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RR
Rog Rapture Gt-ac5300 Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RR
Rog Rapture Gt-ax11000 Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac1200 Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac1200e Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac1200g Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac1200g+ Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac1200gu Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac1200hp Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac1300g+ Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac1300uhp Firmware · Asus
3.0.0.4.386.46061 · source: NVD
RF
Rt-ac2200 Firmware · Asus
3.0.0.4.386.46061 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43702
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43702
Product
https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/
Exploit
https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch