Vulnerability Details CVE-2023-34360
A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.23110 and prior. After a remote attacker logging in device with regular user privilege, the remote attacker can perform a Stored Cross-site Scripting (XSS) attack by uploading image which containing JavaScript code.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 11.6%
CVSS Severity
CVSS v3 Score 8.2
References
Products affected by CVE-2023-34360
-
cpe:2.3:h:asus:rt-ax88u:-
-
cpe:2.3:o:asus:rt-ax88u_firmware:-
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.384.4730
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.384.4736
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.384.5247
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.384.5329
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.384.5640
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.384.5951
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.384.6210
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.42095
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.42819
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.42820
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.44266
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.45375
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.45898
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.45934
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.46061
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.46065
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.48631
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.386.49674
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.388.20499
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.388.20518
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.388.20558
-
cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.388.22525