Riskcovery

CVE-2024-0401

ASUS OVPN RCE

State
Published
Severity
7.2 High
Published
May 20, 2024
Updated
Nov 22, 2025
Reserved
Jan 10, 2024

Read the record on cve.org

Description

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.

Scores

CVSSScoreVectorSource
3.17.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HVulnCheck

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
ExpertWiFiASUS
  • before 3.0.0.6.102_44544Affected
RT-AX55ASUS
  • before 3.0.0.4.386_52303Affected
RT-AX58UASUS
  • before 3.0.0.4.388_24762Affected
RT-AC67UASUS
  • before 3.0.0.4.386_51685Affected
RT-AC68RASUS
  • before 3.0.0.4.386_51685Affected
RT-AC68UASUS
  • before 3.0.0.4.386_51685Affected
RT-AX86 SeriesASUS
  • before 3.0.0.4.388_24243Affected
RT-AC86UASUS
  • before 3.0.0.4.386_51925Affected
RT-AX88UASUS
  • before 3.0.0.4.388_24209Affected
RT-AX3000ASUS
  • before 3.0.0.4.388_24762Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.