CVE-2017-14698
high-risk
Published 2018-01-29
ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote attackers to change passwords of arbitrary users via the http_passwd parameter to mod_login.asp.
Do I need to act?
-
0.45% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (16)
Dsl-Ac51 Firmware
Dsl-Ac52U Firmware
Dsl-Ac55U Firmware
Dsl-N55U C1 Firmware
Dsl-N55U D1 Firmware
Dsl-Ac56U Firmware
Dsl-N10 C1 Firmware
Dsl-N12U C1 Firmware
Dsl-N12E C1 Firmware
Dsl-N14U Firmware
Dsl-N14U-B1 Firmware
Dsl-N16 Firmware
Dsl-N16U Firmware
Dsl-N17U Firmware
Dsl-N66U Firmware
Dsl-Ac750 Firmware
Affected Vendors
References (4)
52
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
2/34 · Minimal
Exposure
18/34 · Moderate