CVE-2017-14698
📋 TL;DR
This vulnerability allows remote attackers to change passwords of arbitrary users on affected ASUS routers via the http_passwd parameter to mod_login.asp. Attackers can gain unauthorized administrative access without authentication. All users of the listed ASUS router models are affected.
💻 Affected Systems
- ASUS DSL-AC51
- DSL-AC52U
- DSL-AC55U
- DSL-N55U C1
- DSL-N55U D1
- DSL-AC56U
- DSL-N10_C1
- DSL-N12U C1
- DSL-N12E C1
- DSL-N14U
- DSL-N14U-B1
- DSL-N16
- DSL-N16U
- DSL-N17U
- DSL-N66U
- DSL-AC750
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to change admin credentials, intercept all network traffic, install malware, and use the router as a pivot point into the internal network.
Likely Case
Attackers gain administrative access to the router, enabling them to change DNS settings, intercept traffic, and potentially compromise connected devices.
If Mitigated
With proper network segmentation and firewall rules, impact is limited to the router itself, though attackers could still disrupt network connectivity.
🎯 Exploit Status
Simple HTTP POST request to mod_login.asp with crafted http_passwd parameter. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check ASUS support site for each model's latest firmware
Vendor Advisory: https://www.asus.com/support/
Restart Required: Yes
Instructions:
1. Visit ASUS support site for your router model. 2. Download latest firmware. 3. Log into router admin panel. 4. Navigate to Administration > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Administration
allPrevents exploitation from internet by disabling remote access to router admin interface
Restrict Admin Interface Access
allLimit access to router admin interface to specific IP addresses or MAC addresses
🧯 If You Can't Patch
- Replace affected routers with patched or different models
- Place router behind another firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version against latest available on ASUS support site. If not latest, assume vulnerable.Check Version:
Log into router admin interface and check Firmware Version in System Status or similar sectionVerify Fix Applied:
Verify firmware version matches latest patched version from ASUS. Test that password change requires proper authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful password change
- HTTP POST requests to mod_login.asp with http_passwd parameter
Network Indicators:
- Unusual HTTP traffic to router admin interface from external IPs
- DNS configuration changes without authorized changes
SIEM Query:
source="router_logs" AND (uri="/mod_login.asp" OR method="POST" AND uri CONTAINS "login")