Read the docs
TI-2020-17814 Aliases CVE-2020-29656GHSA-6fxm-3vcm-r45p

An information disclosure vulnerability exists in RT-AC88U Download Master before…

Priority LOW 35CWE-425Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-425.

Summary

An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language makes it possible to reach "unknown functionality" in a "known to be easy" manner via an unspecified "public exploit."

Why it matters now

EPSS 0.01071 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:asus:rt-ac88u_firmware:*:*:*:*:*:*:*:*before 3.1.0.108VulnerableASUS
cpe:2.3:h:asus:rt-ac88u:-:*:*:*:*:*:*:*not specified by NVDRunning onASUS
  • cpe:2.3:o:asus:rt-ac88u_firmware:*:*:*:*:*:*:*:* Versions before 3.1.0.108 Vulnerable ·ASUS
  • cpe:2.3:h:asus:rt-ac88u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASUS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-29656
  2. 2026-10-03 Alias added: GHSA-6fxm-3vcm-r45p

References

—

  • TI-2021-02220 In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware <… CVSS 3.1HIGH 7.5
  • TI-2018-06731 Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U… CVSS 3.0CRITICAL 9.8
  • TI-2021-19533 ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1CRITICAL 9.0
  • TI-2020-17813 An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences