Security readout for executives and security teams
Plain-English summary
This CVE describes cross-site scripting in an ASUS RT-AC3200 router web component. If an administrator or user is tricked into opening a crafted management URL, attacker-controlled JavaScript could run in that browser context. The bundle does not provide CVSS, a named fix, or active exploitation evidence.
Executive priority
Handle as a targeted network appliance hygiene issue, not a confirmed emergency. Prioritize internet-exposed or broadly reachable router management interfaces first, because compromise of administrative browser sessions can support broader network risk.
Technical view
ASUS RT-AC3200 firmware 3.0.0.4.382.50010 is reported vulnerable in appGet.cgi. The issue is JavaScript execution through the hook URL parameter. The source bundle does not include CWE mapping, exploit maturity, authentication context, or patch version details.
Likely exposure
Exposure is likely limited to ASUS RT-AC3200 devices running firmware 3.0.0.4.382.50010, especially where the router management interface is reachable from user networks or the internet.
Exploitation context
The bundle states attackers can execute JavaScript through the hook parameter. CISA KEV is false, and no cited source in the bundle confirms active exploitation in the wild.
Researcher notes
Evidence is sparse. The CVE record names one model, one firmware version, one CGI endpoint, and one parameter. It does not define required privileges, browser interaction, persistence impact, affected firmware ranges, or a fixed version.
Mitigation direction
- Check ASUS support guidance for fixed firmware or advisories.
- Upgrade affected RT-AC3200 devices if ASUS provides newer firmware.
- Restrict router administration to trusted networks and administrators.
- Disable remote management where it is not required.
- Treat router admin sessions as sensitive browser contexts.
Validation and detection
- Inventory ASUS RT-AC3200 routers and record firmware versions.
- Confirm whether any device runs firmware 3.0.0.4.382.50010.
- Verify management interfaces are not exposed beyond trusted networks.
- Review web logs for appGet.cgi requests containing a hook parameter.
- Document compensating controls if firmware cannot be updated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-14710 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.