246
CVEs
29
Critical
114
High
2
KEV
66
PoC
141
Unpatched C/H
1.6%
Patch Rate
4.1%
Avg EPSS
Severity Breakdown
CRITICAL
29
HIGH
114
MEDIUM
100
LOW
3
Monthly CVE Trend
Affected Products (30)
Asmb8 Ikvm Firmware
19
Z10Pe D16 Ws Firmware
18
Rt Ac86U Firmware
18
Z10Pr D16 Firmware
18
E700 G4 Firmware
17
Rs720A E9 Rs12V2 Firmware
17
Rs700A E9 Rs4 Firmware
17
Rs500A E10 Rs4 Firmware
17
Rs700 E9 Rs12 Firmware
17
Rs500 E9 Rs4 Firmware
17
Z11Pa D8 Firmware
17
Ws X299 Pro Se Firmware
17
Rs500A E9 Rs4 Firmware
17
Z11Pa D8C Firmware
17
Esc4000 G4X Firmware
17
Rs720Q E9 Rs8 Firmware
17
Rs720 E9 Rs24 U Firmware
17
Rs520 E9 Rs8 Firmware
17
Rs520 E9 Rs12 E Firmware
17
Esc4000 Dhd G4 Firmware
17
Rs720A E9 Rs24V2 Firmware
17
Rs720A E9 Rs24 E Firmware
17
Rs720 E9 Rs8 G Firmware
17
Rs100 E10 Pi2 Firmware
17
Knpa U16 Firmware
17
Esc4000 G4 Firmware
17
Z11Pa U12 Firmware
17
Rs500 E9 Ps4 Firmware
17
Rs500A E9 Rs4 U Firmware
17
Ws C422 Pro Se Firmware
17
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2014-9583 | common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.0%. | CRITICAL | 10.0 | 91.0% | 176 |
PoC
No patch
|
| CVE-2012-4924 | Buffer overflow in the CxDbgPrint function in the ipswcom.dll ActiveX component 1.0.0.1 for ASUS Net4Switch 1.0.0020 allows remote attackers to execute arbitrary code via a long parameter to the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.3%. | CRITICAL | 9.3 | 84.3% | 166 |
PoC
No patch
|
| CVE-2017-6548 | Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 48.3%. | CRITICAL | 9.8 | 48.3% | 117 |
PoC
No patch
|
| CVE-2013-5948 | The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 43.8%. | HIGH | 8.5 | 43.8% | 106 |
PoC
No patch
|
| CVE-2013-6343 | Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow remote attackers to execute arbitrary code via the (1) apps_name or (2). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 35.0%. | CRITICAL | 10.0 | 35.0% | 105 |
PoC
No patch
|
| CVE-2017-6549 | Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 24.5%. | HIGH | 8.8 | 24.5% | 89 |
PoC
No patch
|
| CVE-2018-5999 | An issue was discovered in AsusWRT before 3.0.0.4.384_10007. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 87.2% | 84 |
PoC
No patch
|
| CVE-2018-6000 | An issue was discovered in AsusWRT before 3.0.0.4.384_10007. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 84.2% | 84 |
PoC
No patch
|
| CVE-2013-4659 | Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.5%. | CRITICAL | 9.8 | 11.5% | 81 |
PoC
No patch
|
| CVE-2021-45756 | Asus RT-AC68U <3.0.0.4.385.20633 and RT-AC5300 <3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.7% | 71 |
PoC
No patch
|
| CVE-2018-11491 | ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 6.7% | 69 |
PoC
No patch
|
| CVE-2019-10709 | AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potentially privilege escalation via a crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 11.5% | 69 |
PoC
No patch
|
| CVE-2019-15911 | An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.8% | 69 |
PoC
No patch
|
| CVE-2021-32030 | The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 99.4% | 69 |
KEV
PoC
No patch
|
| CVE-2022-31874 | ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 19.1% | 69 |
PoC
No patch
|