Vulnerability Details CVE-2023-31195
ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be able to mount a man-in-the-middle attack, and a user is tricked to log into the affected device through an unencrypted ('http') connection, the user's session may be hijacked.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 7.4%
CVSS Severity
CVSS v3 Score 5.3
References
- https://jvn.jp/en/jp/JVN34232595/
- https://www.asus.com/networking-iot-servers/wifi-routers/asus-wifi-routers/rt-ax3000/helpdesk_bios/?model2Name=RT-AX3000
- https://jvn.jp/en/jp/JVN34232595/
- https://www.asus.com/networking-iot-servers/wifi-routers/asus-wifi-routers/rt-ax3000/helpdesk_bios/?model2Name=RT-AX3000
Products affected by CVE-2023-31195
-
cpe:2.3:h:asus:rt-ax3000:-
-
cpe:2.3:o:asus:rt-ax3000_firmware:-
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.384_10177
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.386.45898
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.386.46061
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.386.47029
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.386.48631
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.386.48908
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.386.49674
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.388.22237
-
cpe:2.3:o:asus:rt-ax3000_firmware:3.0.0.4.388.22525