Mrbruh

Improper neutralization of special elements used in an OS command allows a remote user to execute arbitrary commands with root privileges. This occurs when crafted parameters are sent to the router while the device is in its factory-default state.

Improper authentication in router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, which enables the execution of administrator operations.

An issue involving Cross-Site Request Forgery (CSRF) and OS Command Injection occurs when special elements used in an OS command are not properly neutralized. This allows an attacker to trick a logged-in administrator into visiting a phishing website, which leads to the execution of arbitrary commands with root privileges on the router.

A Zip Slip issue exists in the ISP Upgrade functionality of the WebUI. This occurs when the system fails to properly validate archives, allowing an authenticated administrator to perform arbitrary file writes via a crafted archive containing directory traversal sequences. Directory traversal is a technique used to access files and directories that are stored outside the web root folder. Successful exploitation can lead to the overwriting of arbitrary files on the underlying system, compromising system integrity and availability.

A command injection issue exists in the Telnet command-line interface (CLI) of the device. This is due to inadequate data sanitization during certain CLI operations. An authenticated attacker with elevated privileges could potentially execute arbitrary system commands. Successful exploitation could result in complete device compromise, potentially leading to loss of confidentiality, integrity, and availability. The vulnerability affects the processing of data within the CLI.

An issue involving insecure storage of sensitive keys was identified in MyASUS. This could potentially allow an unauthorized actor to obtain a token used for communication with certain services.

An insecure sensitive key storage issue was found in MyASUS, potentially allowing an unauthorized actor to obtain a token that could be used to communicate with certain services.

An insufficient validation issue exists in ASUS DriverHub. This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints. The issue may allow untrusted sources to affect system behavior through crafted HTTP requests. The root cause is related to errors in the certificate authentication process. Exploitation of this issue can lead to a denial of service.

The issue resides in the data source validation mechanism within ASUS DriverHub. Insufficient validation allows unauthorized sources to interact with the software's features through crafted HTTP requests. This can lead to remote code execution (RCE). The issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints. Attackers can craft malicious domains to facilitate forged HTTP requests processed by DriverHub.