{"id":"CVE-2024-31162","state":"PUBLISHED","title":"ASUS Download Master - OS Command Injection","description":"The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the device.","publishedAt":"2024-06-14T06:35:07.192Z","updatedAt":"2024-08-02T01:46:04.365Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"twcert"},"assigner":"twcert","products":["ASUS Download Master"],"affected":[{"vendor":"ASUS","product":"Download Master","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThanOrEqual":"3.1.0.113","versionType":"custom"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-7867-8fad9-1.html","https://www.twcert.org.tw/en/cp-139-7868-8a760-2.html"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/31xxx/CVE-2024-31162.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-31162","state":"PUBLISHED","datePublished":"2024-06-14T06:35:07.192Z","dateUpdated":"2024-08-02T01:46:04.365Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2024-03-29T07:18:19.359Z"},"containers":{"cna":{"title":"ASUS Download Master - OS Command Injection","descriptions":[{"lang":"en","value":"The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the device."}],"affected":[{"vendor":"ASUS","product":"Download Master","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThanOrEqual":"3.1.0.113","versionType":"custom"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7867-8fad9-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-7868-8a760-2.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2024-06-14T06:35:07.192Z"},"datePublic":"2024-06-14T06:34:00.000Z","impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to 3.1.0.114 or later version."}],"value":"Update to 3.1.0.114 or later version."}],"source":{"advisory":"TVN-202406007","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"asus","product":"download_master","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.1.0.113","versionType":"custom"}],"cpes":["cpe:2.3:a:asus:download_master:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-18T20:29:57.054644Z","id":"CVE-2024-31162","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-18T20:43:05.443Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7867-8fad9-1.html","tags":["third-party-advisory","x_transferred"]},{"url":"https://www.twcert.org.tw/en/cp-139-7868-8a760-2.html","tags":["third-party-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T01:46:04.365Z"}}]}}}