JVN#34232595: ASUS Router RT-AX3000 vulnerable to using sensitive cookies without 'Secure' attribute

ASUS Router RT-AX3000 provided by ASUSTeK COMPUTER INC. uses sensitive cookies without ‘Secure’ attribute (CWE-614).

Impact

When an attacker is in a position to be able to mount a man-in-the-middle attack, and a user is tricked to log into the affected device through an unencrypted (‘http’) connection, the user’s session may be hijacked.

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.

Products Affected

• ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403