CVE-2020-35219

The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST…

published January 4, 2021

CVSS
—
EPSS
2%
Percentile
76.8
In the wild
Unconfirmed
What it is

⚠️ A crafty POST request could let attackers reset your ASUS modem admin password without any checks! Think of it like an unguarded hotel lobby where anyone can walk in and change the room keys without a reservation. The lack of authentication means that access control is virtually nonexistent! If exploited, an attacker could gain full control over your modem's admin interface, enabling them to change settings, compromise your network, or even spy on your devices. This could lead to a seriously compromised home network!

Put simply

Think of it like an unguarded hotel lobby where anyone can walk in and change the room keys without a reservation. The lack of authentication means that access control is virtually nonexistent! This vulnerability allows attackers to modify the admin password of the ASUS DSL-N17U modem simply by sending a crafted POST request, bypassing any authentication checks that should be in place.

What to do

If exploited, an attacker could gain full control over your modem's admin interface, enabling them to change settings, compromise your network, or even spy on your devices. This could lead to a seriously compromised home network! To protect yourself, update the firmware to the latest version as soon as possible. You should also consider changing default settings and ensuring your network is secured with strong passwords. Regularly check for firmware updates to keep your modem safe! You've got this! Take these steps and you'll have your network secured in no time! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01686 · 76.8th percentile
Published
2021-01-04T17:50Z
EPSS history
Timeline
  • 04 JAN 17:50Z
    The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST…
    cvelistv5