CVE-2020-15498

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-26 · updated 2026-06-17
Weakness: CWE-295

Description

An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. The router accepts an arbitrary server certificate for a firmware update. The culprit is the --no-check-certificate option passed to wget tool used to download firmware update files.

Affected products

ASUS Rt-Ac1900P Firmware: before 3.0.0.4.385.20253 — fixed in 3.0.0.4.385.20253

How to fix

Upgrade to a fixed version: ASUS Rt-Ac1900P Firmware 3.0.0.4.385.20253. Check the vendor advisory for mitigations.

References

https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=27440
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=27440

Get alerted when CVE-2020-15498 or the next vulnerability affects your stack