by Kastro
Paper/Archive/CVE-2024-3912

CVE-2024-3912

ASUS DSL-N17U — ASUS Router - Upload arbitrary firmware

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.5.635 × 2012.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.

Affected

ProductAffectedFixed inSource
DSL-N17Uearlier – < 1.1.2.3_7921.1.2.3_792CNA
DSL-N55U_C1earlier – < 1.1.2.3_7921.1.2.3_792CNA
DSL-N55U_D1earlier – < 1.1.2.3_7921.1.2.3_792CNA
DSL-N66Uearlier – < 1.1.2.3_7921.1.2.3_792CNA
DSL-N12U_C1earlier – < 1.1.2.3_8071.1.2.3_807CNA
DSL-N12U_D1earlier – < 1.1.2.3_8071.1.2.3_807CNA
DSL-N14Uearlier – < 1.1.2.3_8071.1.2.3_807CNA
DSL-N14U_B1earlier – < 1.1.2.3_8071.1.2.3_807CNA
DSL-N16earlier – < 1.1.2.3_9991.1.2.3_999CNA
DSL-AC51earlier – < 1.1.2.3_9991.1.2.3_999CNA
DSL-AC750earlier – < 1.1.2.3_9991.1.2.3_999CNA
DSL-AC52Uearlier – < 1.1.2.3_9991.1.2.3_999CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-7875-872d3-1.htmlwriteuptwcert.org.tw/en/cp-139-7876-396bd-2.html