full-disclosure - Re: [FD] Remote Command Execution within the ASUS RT-AC68U Managing Web Interface

Open Source and information security mailing list archives

Message-ID: <CAJVRA1SYzVVH0LNRNDkE62VKCRdG1vYJiQ6h7Neq5daaRNGnTA@mail.gmail.com>
Date: Sun, 6 Apr 2014 03:11:08 -0700
From: coderman <coderman@...il.com>
To: Craig Young <vuln-report@...ur3.us>
Cc: Full Disclosure <fulldisclosure@...lists.org>
Subject: Re: [FD] Remote Command Execution within the ASUS RT-AC68U Managing
 Web Interface

On Fri, Apr 4, 2014 at 2:25 PM, Craig Young <vuln-report@...ur3.us> wrote:
> SOHO router security is quite bad.  This is far from an isolated ping
> injection as most home routers don't bother to sanitize input going to
> ping functionality.

in case that wasn't clear, multiple international SOHO router hardware
shops are releasing products where any arbitrary web CGI element can
lead to elevated arbitrary execution on device...  just a few escapes
away.

not a great security posture to start 2014!

best regards,

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives