CVE-2024-3912

ASUS Router - Upload arbitrary firmware

State: Published
Severity: 9.8 Critical
Published: Jun 14, 2024
Updated: Aug 1, 2024
Reserved: Apr 17, 2024

Description

Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
DSL-N17UASUS	earlier to before 1.1.2.3_792Affected
DSL-N55U_C1ASUS	earlier to before 1.1.2.3_792Affected
DSL-N55U_D1ASUS	earlier to before 1.1.2.3_792Affected
DSL-N66UASUS	earlier to before 1.1.2.3_792Affected
DSL-N12U_C1ASUS	earlier to before 1.1.2.3_807Affected
DSL-N12U_D1ASUS	earlier to before 1.1.2.3_807Affected
DSL-N14UASUS	earlier to before 1.1.2.3_807Affected
DSL-N14U_B1ASUS	earlier to before 1.1.2.3_807Affected
DSL-N16ASUS	earlier to before 1.1.2.3_999Affected
DSL-AC51ASUS	earlier to before 1.1.2.3_999Affected
DSL-AC750ASUS	earlier to before 1.1.2.3_999Affected
DSL-AC52UASUS	earlier to before 1.1.2.3_999Affected
DSL-AC55UASUS	earlier to before 1.1.2.3_999Affected
DSL-AC56UASUS	earlier to before 1.1.2.3_999Affected
DSL-N10_C1ASUS	AllAffected
DSL-N10_D1ASUS	AllAffected
DSL-N10P_C1ASUS	AllAffected
DSL-N12E_C1ASUS	AllAffected
DSL-N16PASUS	AllAffected
DSL-N16UASUS	AllAffected
DSL-AC52ASUS	AllAffected
DSL-AC55ASUS	AllAffected

References

https://www.twcert.org.tw/tw/cp-132-7875-872d3-1.htmlthird-party-advisory
https://www.twcert.org.tw/en/cp-139-7876-396bd-2.htmlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.