Log in Start free

Vulnerability · Published May 20, 2024 · Assigned by VulnCheck

CVE-2024-0401ASUS OVPN RCE

High 7.2

In plain English

A high-severity OS command injection in ExpertWiFi from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.

Affected products (as reported)

VendorProductVersions
ASUS ExpertWiFi 0 – before 3.0.0.6.102_44544
ASUS RT-AX55 0 – before 3.0.0.4.386_52303
ASUS RT-AX58U 0 – before 3.0.0.4.388_24762
ASUS RT-AC67U 0 – before 3.0.0.4.386_51685
ASUS RT-AC68R 0 – before 3.0.0.4.386_51685
ASUS RT-AC68U 0 – before 3.0.0.4.386_51685
ASUS RT-AX86 Series 0 – before 3.0.0.4.388_24243
ASUS RT-AC86U 0 – before 3.0.0.4.386_51925
ASUS RT-AX88U 0 – before 3.0.0.4.388_24209
ASUS RT-AX3000 0 – before 3.0.0.4.388_24762

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References