CVE-2014-2718 Code injection in n/a
Man-in-the-middle attackers can execute arbitrary code on ASUS routers by providing malicious firmware updates due to missing integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2014-2718?
CVE-2014-2718 is a high-severity code injection vulnerability in n/a, published on 4 Nov 2014. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information or (2) downloaded updates, which allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.
Weakness: CWE-345
Which versions are affected by CVE-2014-2718?
It affects 2 products.
Products include Asus Rt Series Firmware, T-Mobile Tm-Ac1900.
How do I fix CVE-2014-2718?
No fix has been published for CVE-2014-2718 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2014-2718 being exploited?
There is no known exploitation of CVE-2014-2718 in the wild and no public exploit code.
Sources
Also known as GHSA-r86x-h62p-fj22.