ByteOS Network

Vulnerability Details :

CVE-2018-11492

Summary

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-10 Aug, 2018 | 16:00

Updated At-05 Aug, 2024 | 08:10

ASUS HG100 devices allow denial of service via an IPv4 packet flood.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:10 Aug, 2018 | 16:00

Updated At:05 Aug, 2024 | 08:10

▼CVE Numbering Authority (CNA)

ASUS HG100 devices allow denial of service via an IPv4 packet flood.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://mars-cheng.github.io/blog/2018/CVE-2018-11492/	x_refsource_MISC
https://www.exploit-db.com/exploits/46720/	exploit x_refsource_EXPLOIT-DB
http://packetstormsecurity.com/files/152542/ASUS-HG100-Denial-Of-Service.html	x_refsource_MISC

Hyperlink: https://mars-cheng.github.io/blog/2018/CVE-2018-11492/

Resource:

x_refsource_MISC

Hyperlink: https://www.exploit-db.com/exploits/46720/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: http://packetstormsecurity.com/files/152542/ASUS-HG100-Denial-Of-Service.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://mars-cheng.github.io/blog/2018/CVE-2018-11492/	x_refsource_MISC x_transferred
https://www.exploit-db.com/exploits/46720/	exploit x_refsource_EXPLOIT-DB x_transferred
http://packetstormsecurity.com/files/152542/ASUS-HG100-Denial-Of-Service.html	x_refsource_MISC x_transferred

Hyperlink: https://mars-cheng.github.io/blog/2018/CVE-2018-11492/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/46720/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: http://packetstormsecurity.com/files/152542/ASUS-HG100-Denial-Of-Service.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:10 Aug, 2018 | 16:29

Updated At:03 Oct, 2019 | 00:03

ASUS HG100 devices allow denial of service via an IPv4 packet flood.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary	2.0	7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C

Type: Primary

Version: 3.0

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 2.0

Base score: 7.8

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:N/I:N/A:C

CPE Matches

ASUS (ASUSTeK Computer Inc.)

>>hg100>>-

cpe:2.3:h:asus:hg100:-:*:*:*:*:*:*:*

ASUS (ASUSTeK Computer Inc.)

>>hg100_firmware>>-

cpe:2.3:o:asus:hg100_firmware:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/152542/ASUS-HG100-Denial-Of-Service.html	cve@mitre.org	N/A
https://mars-cheng.github.io/blog/2018/CVE-2018-11492/	cve@mitre.org	Exploit Third Party Advisory
https://www.exploit-db.com/exploits/46720/	cve@mitre.org	Exploit Third Party Advisory VDB Entry

Hyperlink: http://packetstormsecurity.com/files/152542/ASUS-HG100-Denial-Of-Service.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://mars-cheng.github.io/blog/2018/CVE-2018-11492/

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

Hyperlink: https://www.exploit-db.com/exploits/46720/

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

VDB Entry

Similar CVEs

9Records found

CVE-2018-17020

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.72% / 71.58%

7 Day CHG~0.00%

Published-13 Sep, 2018 | 19:00

Updated-17 Sep, 2024 | 00:42

ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allow remote attackers to cause a denial of service via a single "GET / HTTP/1.1\r\n" line.

Vendor-n/a ASUS (ASUSTeK Computer Inc.)

Product-gt-ac5300_firmware gt-ac5300 n/a

CVE-2022-38393

Matching Score-8

Assigner-Talos

View Details

Matching Score-8

Assigner-Talos

CVSS Score-7.5||HIGH

EPSS-1.46% / 80.04%

7 Day CHG~0.00%

Published-10 Jan, 2023 | 20:37

Updated-14 Jan, 2023 | 04:31

A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

Vendor-ASUS (ASUSTeK Computer Inc.)

Product-rt-ax82u rt-ax82u_firmware RT-AX82U

CWE ID-CWE-125

Out-of-bounds Read

CVE-2021-45757

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.66% / 70.23%

7 Day CHG~0.00%

Published-23 Mar, 2022 | 10:55

Updated-04 Aug, 2024 | 04:47

ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS).

Vendor-n/a ASUS (ASUSTeK Computer Inc.)

Product-rt-ac68u_firmware rt-ac68u n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-41436

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-5.34% / 89.68%

7 Day CHG~0.00%

Published-19 Nov, 2021 | 11:14

Updated-04 Aug, 2024 | 03:15

An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet.

CWE ID-CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVE-2021-3254

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.62% / 69.03%

7 Day CHG~0.00%

Published-11 May, 2022 | 11:55

Updated-03 Aug, 2024 | 16:53

Asus DSL-N14U-B1 1.1.2.3_805 allows remote attackers to cause a Denial of Service (DoS) via a TCP SYN scan using nmap.

Vendor-n/a ASUS (ASUSTeK Computer Inc.)

Product-dsl-n14u-b1_firmware dsl-n14u-b1 n/a

CVE-2021-3229

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.62% / 69.20%

7 Day CHG~0.00%

Published-05 Feb, 2021 | 21:36

Updated-03 Aug, 2024 | 16:53

Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.384_10177 and earlier versions allows an attacker to disrupt the use of device setup services via continuous login error.

Vendor-n/a ASUS (ASUSTeK Computer Inc.)

Product-rt-ax3000 rt-ax3000_firmware n/a

CVE-2018-17127

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.62% / 69.12%

7 Day CHG~0.00%

Published-17 Sep, 2018 | 04:00

Updated-05 Aug, 2024 | 10:39

blocking_request.cgi on ASUS GT-AC5300 devices through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (NULL pointer dereference and device crash) via a request that lacks a timestap parameter.

Vendor-n/a ASUS (ASUSTeK Computer Inc.)

Product-gt-ac5300_firmware gt-ac5300 n/a

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2019-11060

Matching Score-8

Assigner-TWCERT/CC

View Details

Matching Score-8

Assigner-TWCERT/CC

CVSS Score-7.4||HIGH

EPSS-1.34% / 79.22%

7 Day CHG~0.00%

Published-29 Aug, 2019 | 00:19

Updated-16 Sep, 2024 | 17:49

HG100 contains an Uncontrolled Resource Consumption vulnerability

The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time. CVSS 3.0 Base score 7.4 (Availability impacts). CVSS vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).

Vendor-ASUS (ASUSTeK Computer Inc.)

Product-hg100_firmware hg100 HG100 firmware

CWE ID-CWE-400

Uncontrolled Resource Consumption

CWE ID-CWE-770

Allocation of Resources Without Limits or Throttling

CVE-2018-20335

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.67% / 81.36%

7 Day CHG~0.00%

Published-20 Mar, 2020 | 00:11

Updated-05 Aug, 2024 | 11:58

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APP_Installation.asp?= URI.

CWE ID-CWE-20

Improper Input Validation

CVE-2018-11492

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs