{"id":"CVE-2024-3912","state":"PUBLISHED","title":"ASUS Router - Upload arbitrary firmware","description":"Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.","publishedAt":"2024-06-14T09:29:00.161Z","updatedAt":"2024-08-01T20:26:57.193Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"twcert"},"assigner":"twcert","products":["ASUS DSL-N17U","ASUS DSL-N55U_C1","ASUS DSL-N55U_D1","ASUS DSL-N66U","ASUS DSL-N12U_C1","ASUS DSL-N12U_D1","ASUS DSL-N14U","ASUS DSL-N14U_B1","ASUS DSL-N16","ASUS DSL-AC51","ASUS DSL-AC750","ASUS DSL-AC52U","ASUS DSL-AC55U","ASUS DSL-AC56U","ASUS DSL-N10_C1","ASUS DSL-N10_D1","ASUS DSL-N10P_C1","ASUS DSL-N12E_C1","ASUS DSL-N16P","ASUS DSL-N16U","ASUS DSL-AC52","ASUS DSL-AC55"],"affected":[{"vendor":"ASUS","product":"DSL-N17U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N55U_C1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N55U_D1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N66U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N12U_C1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N12U_D1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N14U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N14U_B1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N16","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC51","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC750","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC52U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC55U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC56U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N10_C1","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N10_D1","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N10P_C1","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N12E_C1","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N16P","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N16U","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-AC52","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-AC55","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-7875-872d3-1.html","https://www.twcert.org.tw/en/cp-139-7876-396bd-2.html"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3912.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-3912","state":"PUBLISHED","datePublished":"2024-06-14T09:29:00.161Z","dateUpdated":"2024-08-01T20:26:57.193Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2024-04-17T07:06:03.258Z"},"containers":{"cna":{"title":"ASUS Router - Upload arbitrary firmware","descriptions":[{"lang":"en","value":"Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device."}],"affected":[{"vendor":"ASUS","product":"DSL-N17U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N55U_C1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N55U_D1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N66U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N12U_C1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N12U_D1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N14U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N14U_B1","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N16","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC51","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC750","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC52U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC55U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-AC56U","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}]},{"vendor":"ASUS","product":"DSL-N10_C1","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N10_D1","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N10P_C1","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N12E_C1","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N16P","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-N16U","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-AC52","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"ASUS","product":"DSL-AC55","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7875-872d3-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-7876-396bd-2.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2024-06-14T10:57:26.604Z"},"datePublic":"2024-06-14T09:28:00.000Z","impacts":[{"capecId":"CAPEC-17","descriptions":[{"lang":"en","value":"CAPEC-17 Using Malicious Files"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update following models to version 1.1.2.3_792 or later：<br>DSL-N17U, DSL-N55U_C1, DSL-N55U_D1, DSL-N66U<br><br>Update following models to version 1.1.2.3_807 or later：<br>DSL-N12U_C1, DSL-N12U_D1, DSL-N14U, DSL-N14U_B1<br><br>Update following models to version 1.1.2.3_999 or later：<br>DSL-N16, DSL-AC51, DSL-AC750, DSL-AC52U, DSL-AC55U, DSL-AC56U<br><br>The following models are no longer maintained, and it is recommended to retire and replace them.<br>DSL-N10_C1, DSL-N10_D1, DSL-N10P_C1, DSL-N12E_C1, ,DSL-N16P, DSL-N16U, DSL-AC52, DSL-AC55<br>\n\n<span style=\"background-color: rgb(255, 255, 255);\">If replacement is not possible in the short term, it is recommended to disable remote access (Web access from WAN), virtual servers (Port forwarding), DDNS, VPN server, DMZ, and port trigger.</span>\n\n<br>"}],"value":"Update following models to version 1.1.2.3_792 or later：\nDSL-N17U, DSL-N55U_C1, DSL-N55U_D1, DSL-N66U\n\nUpdate following models to version 1.1.2.3_807 or later：\nDSL-N12U_C1, DSL-N12U_D1, DSL-N14U, DSL-N14U_B1\n\nUpdate following models to version 1.1.2.3_999 or later：\nDSL-N16, DSL-AC51, DSL-AC750, DSL-AC52U, DSL-AC55U, DSL-AC56U\n\nThe following models are no longer maintained, and it is recommended to retire and replace them.\nDSL-N10_C1, DSL-N10_D1, DSL-N10P_C1, DSL-N12E_C1, ,DSL-N16P, DSL-N16U, DSL-AC52, DSL-AC55\n\n\nIf replacement is not possible in the short term, it is recommended to disable remote access (Web access from WAN), virtual servers (Port forwarding), DDNS, VPN server, DMZ, and port trigger."}],"source":{"advisory":"TVN-202406011","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"asus","product":"dsl-n66u_firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.2.3_792","versionType":"custom"}],"cpes":["cpe:2.3:o:asus:dsl-n55u_d1_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n17u_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n55u_c1_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n66u_firmware:-:*:*:*:*:*:*:*"]},{"vendor":"asus","product":"dsl-n12u_c1_firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.2.3_807","versionType":"custom"}],"cpes":["cpe:2.3:h:asus:dsl-n14u_b1:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n14u_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n12u_c1_firmware:-:*:*:*:*:*:*:*"]},{"vendor":"asus","product":"dsl-ac55_firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.2.3_999","versionType":"custom"}],"cpes":["cpe:2.3:o:asus:dsl-ac56u_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-ac55u_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-ac52u_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-ac750_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-ac51_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n16p_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n10p_c1_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n10_d1_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-ac52_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-ac55_firmware:-:*:*:*:*:*:*:*"]},{"vendor":"asus","product":"dsl-n10_c1_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"*","versionType":"custom"}],"cpes":["cpe:2.3:o:asus:dsl-n16p_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n10p_c1_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n10_d1_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-ac52_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-ac55_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n16_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n12e_c1_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:asus:dsl-n10_c1_firmware:-:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-27T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2024-3912"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-28T03:55:21.068Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7875-872d3-1.html","tags":["third-party-advisory","x_transferred"]},{"url":"https://www.twcert.org.tw/en/cp-139-7876-396bd-2.html","tags":["third-party-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:26:57.193Z"}}]}}}