CVE-2017-14698 : ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N1

ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote attackers to change passwords of arbitrary users via the http_passwd parameter to mod_login.asp.

Published 2018-01-29 16:29:00

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2017-14698

Asus » Dsl-ac51 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-ac51_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-ac51 » Version: N/A
Asus » Dsl-ac52u Firmware » Version: N/A
cpe:2.3:o:asus:dsl-ac52u_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-ac52u » Version: N/A
Asus » Dsl-ac55u Firmware » Version: N/A
cpe:2.3:o:asus:dsl-ac55u_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-ac55u » Version: N/A
Asus » Dsl-n55u C1 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n55u_c1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n55u C1 » Version: N/A
Asus » Dsl-n55u D1 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n55u_d1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n55u D1 » Version: N/A
Asus » Dsl-ac56u Firmware » Version: N/A
cpe:2.3:o:asus:dsl-ac56u_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-ac56u » Version: N/A
Asus » Dsl-n10 C1 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n10_c1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n10 C1 » Version: N/A
Asus » Dsl-n12u C1 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n12u_c1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n12u C1 » Version: N/A
Asus » Dsl-n12e C1 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n12e_c1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n12e C1 » Version: N/A
Asus » Dsl-n14u Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n14u_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n14u » Version: N/A
Asus » Dsl-n14u-b1 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n14u-b1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n14u-b1 » Version: N/A
Asus » Dsl-n16 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n16_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n16 » Version: N/A
Asus » Dsl-n16u Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n16u_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n16u » Version: N/A
Asus » Dsl-n17u Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n17u_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n17u » Version: N/A
Asus » Dsl-n66u Firmware » Version: N/A
cpe:2.3:o:asus:dsl-n66u_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-n66u » Version: N/A
Asus » Dsl-ac750 Firmware » Version: N/A
cpe:2.3:o:asus:dsl-ac750_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Asus » Dsl-ac750 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-14698

EPSS FAQ

0.71%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 80 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-14698

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-14698

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-14698

https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers/

Some vulnerability in ASUS routers - Security Art Work
Broken Link
https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/

DSL-N14U B1 BIOS & FIRMWARE | Networking | ASUS Global
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2017-14698

Products affected by CVE-2017-14698

Exploit prediction scoring system (EPSS) score for CVE-2017-14698

CVSS scores for CVE-2017-14698

CWE ids for CVE-2017-14698

References for CVE-2017-14698