CVE-2017-15655

Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages.

• CWE-119

• http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jan/63Exploit, Mailing List, Third Party Advisory
• http://sploit.tech/2018/01/16/ASUS-part-I.htmlExploit, Third Party Advisory
• http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jan/63Exploit, Mailing List, Third Party Advisory
• http://sploit.tech/2018/01/16/ASUS-part-I.htmlExploit, Third Party Advisory

Published

Jan 31, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1565IBM Rational Quality Manager and IBM Rational Collaborative …5.4
• CVE-2017-15650musl libc before 1.1.17 has a buffer overflow via crafted DN…
• CVE-2017-15651PRTG Network Monitor 17.3.33.2830 allows remote authenticate…
• CVE-2017-15652Artifex Ghostscript 9.22 is affected by: Obtain Information.…
• CVE-2017-15653Improper administrator IP validation after his login in the …
• CVE-2017-15654Highly predictable session tokens in the HTTPd server in all…
• CVE-2017-15656Password are stored in plaintext in nvram in the HTTPd serve…
• CVE-2017-15662In Flexense VX Search Enterprise v10.1.12, the Control Proto…
• CVE-2017-15663In Flexense Disk Pulse Enterprise v10.1.18, the Control Prot…
• CVE-2017-15664In Flexense Sync Breeze Enterprise v10.1.16, the Control Pro…
• CVE-2017-15665In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol…
• CVE-2017-15667In Flexense SysGauge Server 3.6.18, the Control Protocol suf…