On Fri, Apr 4, 2014 at 11:08 AM, Palula Brasil <[email protected]> wrote: >... > Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web > Interface > ... > * Impact: This vulnerability allows for performing attacks against third party > users of the ASUS RT-AC68U web management platform, by luring them > into clicking on a link provided with malicious content, which in > turn, will execute on the context of the victim's browser.
fun; i keep waiting for these vulns to get old, but it's just still funny, every time! best regards, p.s. see also: "How I Hacked Your Router" http://disconnected.io/2014/03/18/how-i-hacked-your-router/ "Security Flaws in Universal Plug and Play: Unplug, Don't Play" https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play "DNS Cache Poisoning Issue ("Kaminsky bug") (CVE-2008-1447)" these tales of woe go on in consumer internet of buggy things -i-verse for eons. thus i need say no more. *grin* more of this story: try to break your hardware before it gets broken; if you can't make it not break under known methods, build/install something better! [you can install Tomato on a RT-AC68U with functional Tor transproxy and administration via ssh only, as just one example.] _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
