Vulnerability Name:

CVE-2014-2718 (CCN-98316)

Assigned:2014-10-28
Published:2014-10-28
Updated:2017-08-29
Summary:ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information or (2) downloaded updates, which allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:7.1 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:C/A:N)
5.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:C/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-345
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2014-2718

Source: MISC
Type: Exploit
http://dnlongen.blogspot.com/2014/10/CVE-2014-2718-Asus-RT-MITM.html

Source: MISC
Type: Exploit
http://packetstormsecurity.com/files/128904/ASUS-Router-Man-In-The-Middle.html

Source: CCN
Type: Full Disclosure Mailing List, Tue, 28 Oct 2014 11:29:48 -0500
CVE-2014-2718: ASUS wireless router updates are vulnerable to a MITM attack

Source: FULLDISC
Type: Exploit
20141028 CVE-2014-2718: ASUS wireless router updates are vulnerable to a MITM attack

Source: CCN
Type: ASUS Web site
RT routers

Source: BID
Type: UNKNOWN
70791

Source: CCN
Type: BID-70791
ASUS RT Series Wireless Routers CVE-2014-2718 Man in the Middle Security Bypass Vulnerability

Source: XF
Type: UNKNOWN
asus-cve20142718-mitm(98316)

Source: XF
Type: UNKNOWN
asus-cve20142718-mitm(98316)

Source: CONFIRM
Type: UNKNOWN
https://support.t-mobile.com/docs/DOC-21994

Vulnerable Configuration:Configuration 1:
  • cpe:/o:t-mobile:tm-ac1900:3.0.0.4.376_3169:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:asus:rt_series_firmware:*:*:*:*:*:*:*:* (Version <= 3.0.0.4.374.x)
  • AND
  • cpe:/h:asus:rt-ac56r:*:*:*:*:*:*:*:*
  • OR cpe:/h:asus:rt-ac66r:*:*:*:*:*:*:*:*
  • OR cpe:/h:asus:rt-ac66u:*:*:*:*:*:*:*:*
  • OR cpe:/h:asus:rt-ac68u:*:*:*:*:*:*:*:*
  • OR cpe:/h:asus:rt-n56r:*:*:*:*:*:*:*:*
  • OR cpe:/h:asus:rt-n56u:*:*:*:*:*:*:*:*
  • OR cpe:/h:asus:rt-n66r:*:*:*:*:*:*:*:*
  • OR cpe:/h:asus:rt-n66u:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.270:*:*:*:*:*:*:*
  • OR cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.260:*:*:*:*:*:*:*
  • OR cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.246:*:*:*:*:*:*:*
  • OR cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.220:*:*:*:*:*:*:*
  • OR cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.140:*:*:*:*:*:*:*
  • OR cpe:/o:asus:rt-ac66u_firmware:3.0.0.4.354:*:*:*:*:*:*:*
  • OR cpe:/o:asus:rt-ac68u_firmware:3.0.0.4.374.4755:*:*:*:*:*:*:*
  • OR cpe:/h:asus:rt-ac68u:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    t-mobile tm-ac1900 3.0.0.4.376_3169
    asus rt series firmware *
    asus rt-ac56r *
    asus rt-ac66r *
    asus rt-ac66u *
    asus rt-ac68u *
    asus rt-n56r *
    asus rt-n56u *
    asus rt-n66r *
    asus rt-n66u *
    asus rt-ac66u firmware 3.0.0.4.270
    asus rt-ac66u firmware 3.0.0.4.260
    asus rt-ac66u firmware 3.0.0.4.246
    asus rt-ac66u firmware 3.0.0.4.220
    asus rt-ac66u firmware 3.0.0.4.140
    asus rt-ac66u firmware 3.0.0.4.354
    asus rt-ac68u firmware 3.0.0.4.374.4755
    asus rt-ac68u -