Cross Site Scripting (XSS) vulnerability in router Asus DSL-N14U-B1 1.1.2.3805 via the "list" parameters (e.g. filterlwlist, keywordrulelist, etc) in every ".asp" page containing a list of stored strings. The following asp files are affected: (1) cgi-bin/APPInstallation.asp, (2) cgi-bin/AdvancedACLContent.asp, (3) cgi-bin/AdvancedADSLContent.asp, (4) cgi-bin/AdvancedASUSDDNSContent.asp, (5) cgi-bin/AdvancedAiDiskftp.asp, (6) cgi-bin/AdvancedAiDisksamba.asp, (7) cgi-bin/AdvancedDSLContent.asp, (8) cgi-bin/AdvancedFirewallContent.asp, (9) cgi-bin/AdvancedFirmwareUpgradeContent.asp, (10) cgi-bin/AdvancedGWStaticRouteContent.asp, (11) cgi-bin/AdvancedIPTVContent.asp, (12) cgi-bin/AdvancedIPv6Content.asp, (13) cgi-bin/AdvancedKeywordFilterContent.asp, (14) cgi-bin/AdvancedLANContent.asp, (15) cgi-bin/AdvancedModemContent.asp, (16) cgi-bin/AdvancedPortTriggerContent.asp, (17) cgi-bin/AdvancedQOSUserPrioContent.asp, (18) cgi-bin/AdvancedQOSUserRulesContent.asp, (19) cgi-bin/AdvancedSettingBackupContent.asp, (20) cgi-bin/AdvancedSystemContent.asp, (21) cgi-bin/AdvancedURLFilterContent.asp, (22) cgi-bin/AdvancedVPNPPTP.asp, (23) cgi-bin/AdvancedVirtualServerContent.asp, (24) cgi-bin/AdvancedWANPortContent.asp, (25) cgi-bin/AdvancedWAdvancedContent.asp, (26) cgi-bin/AdvancedWModeContent.asp, (27) cgi-bin/AdvancedWWPSContent.asp, (28) cgi-bin/AdvancedWirelessContent.asp, (29) cgi-bin/BandwidthLimiter.asp, (30) cgi-bin/Guestnetwork.asp, (31) cgi-bin/MainAccessLogContent.asp, (32) cgi-bin/MainAdslStatusContent.asp, (33) cgi-bin/MainSpectrumContent.asp, (34) cgi-bin/MainWebHistoryContent.asp, (35) cgi-bin/ParentalControl.asp, (36) cgi-bin/QISwizard.asp, (37) cgi-bin/QoSEZQoS.asp, (38) cgi-bin/aidisk.asp, (39) cgi-bin/aidisk/Aidisk-1.asp, (40) cgi-bin/aidisk/Aidisk-2.asp, (41) cgi-bin/aidisk/Aidisk-3.asp, (42) cgi-bin/aidisk/Aidisk-4.asp, (43) cgi-bin/blocking.asp, (44) cgi-bin/cloudmain.asp, (45) cgi-bin/cloudroutersync.asp, (46) cgi-bin/cloudsettings.asp, (47) cgi-bin/cloudsync.asp, (48) cgi-bin/device-map/DSLdashboard.asp, (49) cgi-bin/device-map/clients.asp, (50) cgi-bin/device-map/disk.asp, (51) cgi-bin/device-map/internet.asp, (52) cgi-bin/errorpage.asp, (53) cgi-bin/index.asp, (54) cgi-bin/index2.asp, (55) cgi-bin/qis/QISPTMmanualsetting.asp, (56) cgi-bin/qis/QISadminpass.asp, (57) cgi-bin/qis/QISannexsetting.asp, (58) cgi-bin/qis/QISbridgecfgtmp.asp, (59) cgi-bin/qis/QISdetect.asp, (60) cgi-bin/qis/QISfinish.asp, (61) cgi-bin/qis/QISipoacfgtmp.asp, (62) cgi-bin/qis/QISmanualsetting.asp, (63) cgi-bin/qis/QISmercfg.asp, (64) cgi-bin/qis/QISmercfgtmp.asp, (65) cgi-bin/qis/QISpppcfg.asp, (66) cgi-bin/qis/QISpppcfgtmp.asp, (67) cgi-bin/qis/QISwireless.asp, (68) cgi-bin/querywanstatus.asp, (69) cgi-bin/querywanstatus2.asp, and (70) cgi-bin/startapply.asp.

Asus DSL-N14U-B1 1.1.2.3805 allows remote attackers to cause a Denial of Service (DoS) via a TCP SYN scan using nmap.

An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3805 devices. An attacker can upload arbitrary file content as a firmware update when the filename SettingsDSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update, resulting in a persistent outage of those services.

ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote attackers to change passwords of arbitrary users via the httppasswd parameter to modlogin.asp.

Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote authenticated users to read arbitrary files via a crafted DTD in (1) an UPDATEACCOUNT or (2) a PROPFIND request.