Affected: asus rt-ac58u_firmware

A cross site scripting (XSS) vulnerability on ASUS RT-AC58U 3.0.0.4.380_6516 devices allows remote attackers to inject arbitrary web script or HTML via Advanced_ASUSDDNS_Content.asp, Advanced_WSecurity_Content.asp, Advanced_Wireless_Content.asp, Logout.asp, Main_Login.asp, MobileQIS_Login.asp, QIS_wizard.htma, YandexDNS.asp, ajax_status.xml, apply.cgi, clients.asp, disk.asp, disk_utility.asp, or internet.asp.

Technical details: The vulnerability affects multiple ASP pages including Advanced_Wireless_Content.asp, Main_Login.asp, and various other administrative components that are accessible without authentication. The exploit works by crafting a malicious URL containing JavaScript injection (e.g., 192.168.1.1/Advanced_Wireless_Content.aspn9mn0'-alert(1)-'grqb0) which the router reflects back in an unescaped script tag during the redirect to the login page. The vulnerability allows attackers to execute arbitrary JavaScript in victims' browsers when they open the prepared URL, potentially leading to session hijacking or credential theft. This is a security research repository documenting the vulnerability discovered in October 2018.

Affected: ASUS RT-AC58U Firmware

CVE-2018-18287 is an information disclosure vulnerability that affects ASUS routers running specific firmware versions. The vulnerability exists in the router's web interface and allows unauthorized access to sensitive network data.

Technical details: The vulnerability is present in the main login page (Main_Login.asp) and additional pages of the router's web interface. These pages inadvertently expose:

DHCP Lease Information: Complete list of devices connected to the network, including IP addresses and hostnames Network Time Information: Current time, date, and system uptime statistics Network Topology: Details about active network clients This information is accessible without authentication, allowing any user with network access to the router's web interface to extract sensitive data about the network and connected devices.

Affected: orange airbox_firmware

goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials.

Technical details: t: The vulnerability exists in the goform/setReset endpoint on the device web interface. Type of Vulnerability: Missing Authorization (CWE-862). The device does not enforce any authentication or authorization when accessing the reset function. Attack Mechanism: An unauthenticated attacker on the same network (or with the ability to send requests to the device) can POST to the /goform/setReset endpoint. Impact: The device is reset to factory settings. Following the reset, the attacker can log in using the default credentials (admin:admin). This can allow the attacker to take full control of the device, alter configurations, or intercept network traffic passing through the router.

Affected: orange airbox_firmware

goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.

Technical details: AirBox has hidden webpage http://192.168.1.1/goform/getWlanClientInfo?rand= which prints currently connected devices ip,hostnames,mac addresses and connection time.

Affected: orange airbox_firmware

goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.

Technical details: AirBoxAPNLeaks is a Python-based proof-of-concept exploit demonstrating CVE-2018-18375, a security vulnerability affecting Orange AirBox routers running firmware Y858_FL_01.16_04. The tool exploits an exposed HTTP endpoint (/goform/getProfileList) that leaks sensitive APN (Access Point Name) configuration details including usernames, passwords, and phone numbers without authentication. The implementation utilizes the requests library to send HTTP GET requests to the vulnerable router and parse the returned HTML content containing the leaked credentials. This vulnerability allows attackers on the local network to steal external IP addresses and mobile network authentication credentials, posing significant privacy and security risks. The repository contains a single 15-line Python script with command-line argument parsing for specifying target router IP addresses.