CVE-2020-23648

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can change the administrator password without any authentication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-236539.8An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/w CVE-2020-236545.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."CVE-2020-236555.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."CVE-2020-236565.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."CVE-2020-236575.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."CVE-2020-236585.4PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.CVE-2020-236595.4WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.CVE-2020-236605.4webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."CVE-2020-236799.8Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field CVE-2020-236807.8An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possib CVE-2020-236859.8SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the usernam CVE-2020-236868.8Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified i