ASUS Rt-AC3200 Firmware vulnerabilities

7 CVEs affecting ASUS Rt-AC3200 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-43702, published 2022-07-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-14714, published 2019-05-13. Critical severity, CVSS 9.8. EPSS: 27.4% chance of exploitation in the next 30 days. System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "load_script" URL parameter.
CVE-2018-14710, published 2019-05-13. Medium severity, CVSS 6.1. EPSS: 5.3% chance of exploitation in the next 30 days. Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the "hook" URL parameter.
CVE-2018-14712, published 2019-05-13. Medium severity, CVSS 6.5. EPSS: 4.1% chance of exploitation in the next 30 days. Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the "hook" URL parameter.
CVE-2018-14713, published 2019-05-13. High severity, CVSS 8.1. EPSS: 3.8% chance of exploitation in the next 30 days. Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers via the "hook" URL parameter.
CVE-2018-9285, published 2018-04-04. Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days. Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices before 3.0.0.4.382.39935;…
CVE-2021-43702, published 2022-07-05. Critical severity, CVSS 9.0. EPSS: 1% chance of exploitation in the next 30 days. ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the…
CVE-2018-14711, published 2019-05-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs.