CVE-2017-11420
Last modified
CVE-2017-11420 is a vulnerability of currently unknown severity. Stack-based buffer overflow in ASUS_Discovery.c in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code via long device information that is mishandled during a strcat to a device list.. EPSS estimates a 5.61% chance of exploitation in the next 30 days.
Description
Stack-based buffer overflow in ASUS_Discovery.c in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code via long device information that is mishandled during a strcat to a device list.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Asuswrt-Merlin Project | Rt-Ac5300 Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt Ac1900p Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-Ac68u Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-Ac68p Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-Ac88u Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-Ac66u Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-Ac66u B1 Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-Ac58u Firmware | <= 3.0.0.4.380.7485 |
| Asuswrt-Merlin Project | Rt-Ac56u Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-Ac55u Firmware | <= 3.0.0.4.380.7378 |
| Asuswrt-Merlin Project | Rt-Ac52u Firmware | <= 3.0.0.4.380.4180 |
| Asuswrt-Merlin Project | Rt-Ac51u Firmware | <= 3.0.0.4.380.7378 |
| Asuswrt-Merlin Project | Rt-N18u Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-N66u Firmware | <= 3.0.0.4.380.7378 |
| Asuswrt-Merlin Project | Rt-N56u Firmware | <= 3.0.0.4.378.7177 |
| Asuswrt-Merlin Project | Rt-Ac3200 Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt-Ac3100 Firmware | <= 3.0.0.4.380.7743 |
| Asuswrt-Merlin Project | Rt Ac1200gu Firmware | <= 3.0.0.4.380.5577 |
| Asuswrt-Merlin Project | Rt Ac1200g Firmware | <= 3.0.0.4.380.3167 |
| Asuswrt-Merlin Project | Rt-Ac1200 Firmware | <= 3.0.0.4.380.9880 |
| Asuswrt-Merlin Project | Rt-Ac53 Firmware | <= 3.0.0.4.380.9883 |
| Asuswrt-Merlin Project | Rt-N12hp Firmware | <= 3.0.0.4.380.2943 |
| Asuswrt-Merlin Project | Rt-N12hp B1 Firmware | <= 3.0.0.4.380.3479 |
| Asuswrt-Merlin Project | Rt-N12d1 Firmware | <= 3.0.0.4.380.7378 |
| Asuswrt-Merlin Project | Rt-N12\+ Firmware | <= 3.0.0.4.380.7378 |
| Asuswrt-Merlin Project | Rt N12\+ Pro Firmware | <= 3.0.0.4.380.9880 |
| Asuswrt-Merlin Project | Rt-N16 Firmware | <= 3.0.0.4.380.7378 |
| Asuswrt-Merlin Project | Rt-N300 Firmware | <= 3.0.0.4.380.7378 |
References
- http://www.openwall.com/lists/oss-security/2017/07/13/1Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/07/13/1Exploit, Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-11420?
How severe is CVE-2017-11420?
How do I fix CVE-2017-11420?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-11415Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/s…
- CVE-2017-11416Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/contro…
- CVE-2017-11417Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/c…
- CVE-2017-11418Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/c…
- CVE-2017-11419Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/contro…
- CVE-2017-1142IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a …
- CVE-2017-11421gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript In…
- CVE-2017-11422Statamic framework before 2.6.0 does not correctly check a s…8.8
- CVE-2017-11423The cabd_read_string function in mspack/cabd.c in libmspack …
- CVE-2017-11424In PyJWT 1.5.0 and below the `invalid_strings` check in `HMA…
- CVE-2017-11427OneLogin PythonSAML 2.3.0 and earlier may incorrectly utiliz…7.7
- CVE-2017-11428OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize…7.7
Are you affected by CVE-2017-11420?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST