CVE-2023-47678 Missing authorization in RT-AC87U
An attacker can read or write unauthorized files on ASUS RT-AC87U routers via TFTP due to improper access control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-47678?
CVE-2023-47678 is a critical missing authorization vulnerability in ASUSTeK COMPUTER INC. RT-AC87U, published on 15 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An improper access control vulnerability exists in RT-AC87U all versions. An attacker may read or write files that are not intended to be accessed by connecting to a target device via tftp.
Which versions are affected by CVE-2023-47678?
It affects 1 product.
Products include Asus Rt-Ac87u Firmware.
How do I fix CVE-2023-47678?
No fix has been published for CVE-2023-47678 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-47678 being exploited?
There is no known exploitation of CVE-2023-47678 in the wild and no public exploit code.
Other vulnerabilities in ASUSTeK COMPUTER INC. RT-AC87U
Sources
Also known as GHSA-8rh4-mxhq-673g.