What’s Vulnerable › Vulnerabilities

CVE-2016-6557: The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to cross-site request forgery

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-13 · updated 2026-06-17
• Weakness: CWE-352

Description

In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface does not sufficiently verify whether a valid request was intentionally provided by the user. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request.

Affected products

• ASUS Ea-N66 Firmware: all versions
• ASUS Rp-Ac52 Firmware: through 1.0.1.1s
• ASUS Rp-Ac56 Firmware: all versions
• ASUS Rp-N12 Firmware: all versions
• ASUS Rp-N14 Firmware: all versions
• ASUS Rp-N53 Firmware: all versions
• ASUS Wmp-N12 Firmware: all versions

References

• https://www.kb.cert.org/vuls/id/763843
• https://www.securityfocus.com/bid/93596
• https://www.kb.cert.org/vuls/id/763843
• https://www.securityfocus.com/bid/93596

Get alerted when CVE-2016-6557 or the next vulnerability affects your stack