CVE-2021-43702 Cross-site scripting in n/a
An attacker can inject malicious scripts into WiFi logs via SSID, leading to stored XSS in the ASUS router admin panel.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-43702?
CVE-2021-43702 is a critical cross-site scripting vulnerability in n/a, published on 5 Jul 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.
Weakness: CWE-79
Which versions are affected by CVE-2021-43702?
It affects 93 products.
Products include Asus 4g-Ac53u Firmware, Asus 4g-Ac68u Firmware, Asus Rog Rapture Gt-Ac2900 Firmware, Asus Rog Rapture Gt-Ac5300 Firmware, Asus Rog Rapture Gt-Ax11000 Firmware, Asus Rt-Ac1200 Firmware and 87 more.
How do I fix CVE-2021-43702?
No fix has been published for CVE-2021-43702 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-43702 being exploited?
There is no known exploitation of CVE-2021-43702 in the wild and no public exploit code.
Sources
Also known as GHSA-vf6p-785f-8qgq.