The host is running ASUS Router and is prone to multiple vulnerabilities.

Successful exploitation will allow remote attackers to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site and also can conduct phishing attacks. Impact Level: Application

No Solution is available as of 26th February, 2014.Information regarding this issue will be updated once the solution details are available. For more information refer to http://www.asus.com/Networking/RTN56U

- The error page is accessible without authentication. This allows the attacker to bypass same-origin policy restrictions enforced by XMLHttpRequest. - The router error page 'error_page.htm' includes the current administrative password in clear text.

ASUS RT-N16 ASUS RT-N10U, firmware 3.0.0.4.374_168 ASUS RT-N56U, firmware 3.0.0.4.374_979 ASUS DSL-N55U, firmware 3.0.0.4.374_1397 ASUS RT-AC66U, firmware 3.0.0.4.374_2050 ASUS RT-N15U, firmware 3.0.0.4.374_16 ASUS RT-N53, firmware 3.0.0.4.374_311

Send a crafted exploit string via HTTP GET request and check whether it is possible to read cookie or not.

• https://sintonen.fi/advisories/asus-router-auth-bypass.txt

---

Updated on 2017-03-28