CVE-2025-1354

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1354
A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of RT-N10E and RT-N12E are unsupported (End-of-Life, EOL). Consumers can mitigate this vulnerability by disabling the remote access features from WAN

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:L/Au:M/C:N/I:P/A:N

Exploitability : 6.4 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://vuldb.com/?ctiid.295962
https://vuldb.com/?id.295962
https://vuldb.com/?submit.496013
https://www.asus.com/supportonly/rt-n10e/helpdesk_bios/
https://www.asus.com/supportonly/rt-n12e/helpdesk_bios/
https://vuldb.com/?ctiid.295962
https://vuldb.com/?id.295962
https://vuldb.com/?submit.496013
https://www.asus.com/
Configurations

No configuration.

History

13 Mar 2025, 07:15

Type Values Removed Values Added
References
  • () https://www.asus.com/supportonly/rt-n10e/helpdesk_bios/ -
  • () https://www.asus.com/supportonly/rt-n12e/helpdesk_bios/ -
Summary
  • (es) Se ha encontrado una vulnerabilidad en Asus RT-N12E 2.0.0.19. Se ha clasificado como problemática. Se ve afectada una función desconocida del archivo sysinfo.asp. La manipulación del argumento SSID provoca ataques de Cross Site Scripting. Es posible lanzar el ataque de forma remota. El exploit se ha hecho público y puede utilizarse. Se contactó al proveedor con anticipación sobre esta revelación, pero no respondió de ninguna manera.
Summary (en) A vulnerability was found in Asus RT-N12E 2.0.0.19. It has been classified as problematic. Affected is an unknown function of the file sysinfo.asp. The manipulation of the argument SSID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of RT-N10E and RT-N12E are unsupported (End-of-Life, EOL). Consumers can mitigate this vulnerability by disabling the remote access features from WAN

16 Feb 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-16 16:15

Updated : 2025-03-13 07:15

NVD link : CVE-2025-1354

Mitre link : CVE-2025-1354

CVE.ORG link : CVE-2025-1354

JSON object : View

Products Affected

No product.

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')