VulnerabilityModified
CVE-2020-29655
An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108.
HIGH 7.5EPSS 0.91%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. Accessing Main_Login.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp will redirect to the login site, which will show the value of the parameter productname within the title. An attacker might be able to influence the appearance of the login page, aka text injection.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.91% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- asus/rt-ac88u firmware
- Source
- cve@mitre.org
References
- https://vuldb.com/?id.165678Third Party Advisory
- https://vuldb.com/?id.165678Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.