Description
ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ASUS ExpertWiFi
Default version status: unaffected
0 to < 3.0.0.6.102_44544affected
ASUS RT-AX55
Default version status: unaffected
0 to < 3.0.0.4.386_52303affected
ASUS RT-AX58U
Default version status: unaffected
0 to < 3.0.0.4.388_24762affected
ASUS RT-AC67U
Default version status: unaffected
0 to < 3.0.0.4.386_51685affected
ASUS RT-AC68R
Default version status: unaffected
0 to < 3.0.0.4.386_51685affected
ASUS RT-AC68U
Default version status: unaffected
0 to < 3.0.0.4.386_51685affected
ASUS RT-AX86 Series
Default version status: unaffected
0 to < 3.0.0.4.388_24243affected
ASUS RT-AC86U
Default version status: unaffected
0 to < 3.0.0.4.386_51925affected
ASUS RT-AX88U
Default version status: unaffected
0 to < 3.0.0.4.388_24209affected
ASUS RT-AX3000
Default version status: unaffected
0 to < 3.0.0.4.388_24762affected