Information disclosure in ASUS Rt-Ac66u Firmware
CVE-2014-2719
Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.3 (Medium). Vector: AV:N/AC:M/Au:S/C:C/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.011 (65.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 65.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- ASUS Rt-Ac66u Firmware — versions 3.0.0.4.140, 3.0.0.4.220, 3.0.0.4.246
- ASUS Rt-Ac68u
- ASUS Rt-Ac68u Firmware — versions 3.0.0.4.374.4755, 3.0.0.4.374_4561, 3.0.0.4.374_4887
- ASUS Rt-N10e Firmware — versions 2.0.0.7, 2.0.0.10, 2.0.0.16
- ASUS Rt-N14u Firmware — versions 3.0.0.4.322, 3.0.0.4.356
- ASUS Rt-N16 Firmware — versions 1.0.1.9, 1.0.2.3, 3.0.0.3.108
- ASUS Rt-N56u Firmware — versions 1.0.1.4, 1.0.1.4o, 1.0.1.7c
- ASUS Rt-N65u Firmware — versions 3.0.0.3.134, 3.0.0.3.176, 3.0.0.4.260
- ASUS Rt-N66u Firmware — versions 3.0.0.4.272, 3.0.0.4.370
- T-Mobile Tm-Ac1900 — versions 3.0.0.4.376_3169