Vulnerability · Published Apr 15, 2024 · Assigned by twcert
CVE-2024-1655ASUS WiFi Router - OS Command Injection
High 8.8
In plain English
A high-severity OS command injection in ExpertWiFi EBM63 from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.0%top 18.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by sending a specially crafted request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ASUS | ExpertWiFi EBM63 | earlier – before 3.0.0.6.102_32645 |
| ASUS | ExpertWiFi EBM68 | earlier – before 3.0.0.6.102_44384 |
| ASUS | RT-AX57 Go | earlier – before 3.0.0.6.102_22188 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-7737-1acd0-1.html third-party-advisory