VulnerabilityModified
CVE-2021-43702
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS).
CRITICAL 9.0EPSS 0.95%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.
- CVSS 3.1
- 9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- EPSS
- 0.95% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- asus/zenwifi xd4s firmware · asus/zenwifi xt9 firmware · asus/zenwifi xd5 firmware · asus/zenwifi pro et12 firmware · asus/zenwifi pro xt12 firmware · asus/zenwifi ax hybrid firmware · asus/zenwifi et8 firmware · asus/zenwifi xd6 firmware · asus/zenwifi ac mini firmware · asus/zenwifi ax mini firmware · asus/zenwifi ax firmware · asus/zenwifi ac firmware · asus/rt-ac66u b1 firmware · asus/rt-ax88u firmware · asus/rt-ax82u firmware · asus/rt-ax89x firmware · asus/rt-ax92u firmware · asus/rt-ax86u firmware · asus/rt-ax68u firmware · asus/rt-ax3000 firmware · +40 more
- Source
- cve@mitre.org
References
- https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/Product, Vendor Advisory
- https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patchExploit, Third Party Advisory
- https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/Product, Vendor Advisory
- https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patchExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.