ASUS Routers Vulnerable to Code Execution Flaw
CVE-2024-0401

7.2HIGH

Key Information:

Vendor

Asus
Status
Expertwifi
Rt-ax55
Rt-ax58u
Rt-ac67u
Vendor
CVE Published:
20 May 2024

What is CVE-2024-0401?

ASUS routers that support custom OpenVPN profiles are exposed to a serious code execution vulnerability. An authenticated remote attacker can exploit this flaw by uploading a specially crafted OVPN profile, which allows them to execute arbitrary operating system commands. This risk affects various models, including the ASUS ExpertWiFi and several RT series routers. Organizations using these devices should take immediate precautions to mitigate potential exploitation.

Affected Version(s)

ExpertWiFi 0 < 3.0.0.6.102_44544

RT-AC67U 0 < 3.0.0.4.386_51685

RT-AC68R 0 < 3.0.0.4.386_51685

References

https://vulncheck.com/advisories/asus-ovpn-rce
third-party-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jacob Baines
.