CVE-2023-31195: Medium severity asus tuf gaming ax3000 v2 firmware vulnerability
ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be able to mount a man-in-the-middle attack, and a user is tricked to log into the affected device through an unencrypted ('http') connection, the user's session may be hijacked.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this ASUS Router firmware vulnerability?
The vulnerability ID for this ASUS Router firmware vulnerability is CVE-2023-31195.
What is the severity rating of CVE-2023-31195?
The severity rating of CVE-2023-31195 is medium with a score of 5.3.
How does the vulnerability in ASUS Router RT-AX3000 firmware versions prior to 3.0.0.4.388.23403 exploit sensitive cookies?
The vulnerability allows an attacker in a man-in-the-middle position to intercept sensitive cookies when a user logs into the affected device over an unencrypted ('http') connection.
What is the impact of this vulnerability?
This vulnerability allows an attacker to intercept sensitive information, such as login credentials, by exploiting the insecure use of cookies.
How can I fix the vulnerability in ASUS Router RT-AX3000 firmware versions prior to 3.0.0.4.388.23403?
To fix the vulnerability, update the firmware to version 3.0.0.4.388.23403 or higher, which includes the 'Secure' attribute for sensitive cookies.